PT-2023-2420 · Omron · Omron Cs Series

Reid Wightman · Published 2023-01-18 · Updated 2024-01-23 · CVE-2022-45794

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Omron CJ-series and CS-series PLCs, all versions

Description The issue is related to the lack of authentication for a critical function in Omron CS/CJ controllers. An attacker with network access to the affected PLC may use a network protocol to read and write files on the PLC internal memory and memory card, potentially allowing a remote attacker to access protected information.

Recommendations For Omron CJ-series and CS-series PLCs, all versions: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2023-02205

CVE-2022-45794

Affected Products

Omron Cs Series

References · 9

• https://fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-002_en.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02205 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45794 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-108-01 · Note
• https://t.me/cvenotify/66978 · Telegram Post
• https://twitter.com/CVEnew/status/1745228558161920173 · Twitter Post
• https://dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access · Note
• https://t.me/cvenotify/68397 · Telegram Post
• https://ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf · Note