PT-2023-9778 · Omron · Cx-Motion Pro

Michael Heinzl · Published 2023-01-24 · Updated 2025-03-27 · CVE-2023-22322

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OMRON CX-Motion Pro versions 1.4.6.013 and earlier

Description The issue is related to an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Motion Pro is installed may be disclosed.

Recommendations For OMRON CX-Motion Pro versions 1.4.6.013 and earlier, consider avoiding the use of project files from untrusted sources until a patch is available. As a temporary workaround, restrict access to sensitive information in the file system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-10609

CVE-2023-22322

Affected Products

Cx-Motion Pro

References · 7

• https://osv.dev/vulnerability/CVE-2023-22322 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22322 · Security Note
• https://bdu.fstec.ru/vul/2024-10609 · Security Note
• https://t.me/cibsecurity/57156 · Telegram Post
• https://t.me/cvenotify/43064 · Telegram Post
• https://jvn.jp/en/vu/JVNVU94200979 · Note
• https://t.me/cvenotify/116624 · Telegram Post