Omron vulnerabilities, page 3
83 vulnerabilities
Known vulnerabilities in Omron products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 514 products.
HighCVE-2022-2979omron · cx-programmerOmron CX-ProgrammerOpening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.EPSS0.25%HighCVE-2022-26419omron · cx-positionRockwell Automation Studio 5000 Logix Designer Code InjectionOmron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may allow an attacker to locally execute arbitrary code.EPSS2.12%HighCVE-2022-26022omron · cx-positionRockwell Automation Studio 5000 Logix Designer Out-of-Bounds WriteOmron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to execute arbitrary code.EPSS1.50%HighCVE-2022-26417omron · cx-positionRockwell Automation Studio 5000 Logix Designer Use After FreeOmron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may allow an attacker to execute arbitrary code.EPSS1.50%CriticalCVE-2022-31206omron · nj101-1000_firmware +24 moreomron nj101-1000_firmwareThe Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.EPSS1.12%HighCVE-2022-31205omron · cp1w-cif41_firmware +6 moreomron cp1w-cif41_firmwareIn Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication.EPSS0.68%CriticalCVE-2022-31207omron · cp1w-cif41_firmware +6 moreomron cp1w-cif41_firmwareThe Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to the PLC. This protocol has authentication flaws as reported in FSCT-2022-0057. Control logic is downloaded to PLC volatile memory using the FINS Program Area Read and Program Area Write commands or to non-volatile memory using other commands from where it can be loaded into volatile memory for execution. The logic that is loaded into and executed from the user program area exists in compiled object code form. Upon execution, these object codes are first passed to a dedicated ASIC that determines whether the object code is to be executed by the ASIC or the microprocessor. In the former case, the object code is interpreted by the ASIC whereas in the latter case the object code is passed to the microprocessor for object code interpretation by a ROM interpreter. In the abnormal case where the object code cannot be handled by either, an abnormal condition is triggered and the PLC is halted. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, thus allowing an attacker to manipulate transmitted object code to the PLC and either execute arbitrary object code commands on the ASIC or on the microprocessor interpreter.EPSS1.00%HighCVE-2022-31204omron · cp1w-cif41_firmware +7 moreomron cp1w-cif41_firmwareOmron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.EPSS0.67%HighCVE-2022-25325omron corporation · cx-programmer +1 moreomron corporation cx-programmerUse after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25230.EPSS1.08%HighCVE-2022-25230omron corporation · cx-programmer +1 moreomron corporation cx-programmerUse after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25325.EPSS1.08%HighCVE-2022-25959omron · cx-positionRockwell Automation Studio 5000 Logix Designer Improper Restriction of Operations within the Bounds of a Memory BufferOmron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an attacker to execute arbitrary code.EPSS1.47%HighCVE-2022-25234omron corporation · cx-programmer +1 moreomron corporation cx-programmerOut-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-21124.EPSS1.03%HighCVE-2022-43508omron corporation · cx-programmer +1 moreomron corporation cx-programmerUse-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.EPSS0.26%HighCVE-2022-43509omron corporation · cx-programmer +1 moreomron corporation cx-programmerOut-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.EPSS0.25%HighCVE-2022-43667omron corporation · cx-programmer +1 moreomron corporation cx-programmerStack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.EPSS0.28%HighCVE-2022-46282omron corporation · cx-drive +1 moreomron corporation cx-driveUse after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specially crafted file,EPSS0.25%HighCVE-2022-45792omron · sysmac_studioDirectory Traversal in Project File Format allows overwrite (Zip Slip)Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user.EPSS0.33%HighCVE-2022-45793omron · automation_software_sysmac_studio +1 moreExecutable files writable by low-privileged users in Omron Sysmac StudioSysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.EPSS0.27%CriticalCVE-2022-45790omron · cj-series and cs-series cpu modules +46 moreOmron FINS memory protection susceptible to bruteforceThe Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic.EPSS0.91%HighCVE-2022-45794omron · cj-series and cs-series cpu modules +41 moreOmron CJ-series and CS-series unauthenticated filesystem access.An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC internal memory and memory card.EPSS0.54%