PT-2023-5305 · Omron · Cx-Programmer

Michael Heinzl · Published 2023-08-01 · Updated 2023-08-08 · CVE-2023-38746

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CX-Programmer Included in CX-One CXONE-AL[][]D-V4 versions 9.80 and earlier

Description An out-of-bounds read issue exists, which may allow information disclosure and/or arbitrary code execution when a user opens a specially crafted CXP file. This could potentially give an attacker access to confidential information or enable them to execute arbitrary code.

Recommendations For versions 9.80 and earlier, avoid opening specially crafted CXP files until a patch is available. As a temporary workaround, consider restricting access to the CX-Programmer to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2023-05931

CVE-2023-38746

Affected Products

Cx-Programmer

References · 8

• https://ia.omron.com/product/vulnerability/OMSR-2023-005_en.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38746 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05931 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-38746 · Security Note
• https://t.me/cibsecurity/67643 · Telegram Post
• https://jvn.jp/en/vu/JVNVU93286117 · Note
• https://t.me/cvenotify/55679 · Telegram Post
• https://t.me/cvenotify/56022 · Telegram Post