CVE-2022-31204
High
Description
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.
SeverityHigh
CVSS7.5
Exploit probability—
ProductOmron Sysmac Cs1 Firmware
PublishedJul 26, 2022
First seenJul 26, 2022
How to fix
Update
- omron sysmac_cs1_firmware4.1 or later
- omron sysmac_cj2m_firmware2.1 or later
- omron sysmac_cj2h_firmware1.5 or later
- omron sysmac_cp1e_firmware1.30 or later
- omron sysmac_cp1h_firmware1.30 or later
- omron sysmac_cp1l_firmware1.10 or later
- omron cx-programmer9.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| omron sysmac_cs1_firmware | v < 4.1 | 4.1 |
| omron sysmac_cj2m_firmware | v < 2.1 | 2.1 |
| omron sysmac_cj2h_firmware | v < 1.5 | 1.5 |
| omron sysmac_cp1e_firmware | v < 1.30 | 1.30 |
| omron sysmac_cp1h_firmware | v < 1.30 | 1.30 |
| omron sysmac_cp1l_firmware | v < 1.10 | 1.10 |
| omron cp1w-cif41_firmware | No range specified | — |
| omron cx-programmer | v < 9.6 | 9.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.