{"schemaVersion":3,"id":"CVE-2023-38744","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.","dates":{"published":"2023-08-03T04:55:52.423Z","modified":"2024-10-17T15:17:34.756Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00866,"percentile":0.58235,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00866},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00866,"percentile":0.58235}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00866,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00866,"percentile":0.58235}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1284","name":"Improper Validation of Specified Quantity in Input","description":"The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1284.html"}],"affected":[{"vendor":"omron corporation","product":"cj2h cpu unit","name":"CJ2H CPU Unit","label":"cj2h cpu unit","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier","eol":null,"hubHref":"/vendor/omron_corporation/cj2h_cpu_unit"},{"vendor":"omron corporation","product":"cj2m cpu unit","name":"CJ2M CPU Unit","label":"cj2m cpu unit","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier","eol":null,"hubHref":"/vendor/omron_corporation/cj2m_cpu_unit"},{"vendor":"omron corporation","product":"cs/cj series ethernet/ip unit","name":"CS/CJ Series EtherNet/IP Unit","label":"cs/cj series ethernet/ip unit","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"CS1W-EIP21 V3.04 and earlier","noFixRecorded":false,"fixedIn":null},{"text":"CJ1W-EIP21 V3.04 and earlier","noFixRecorded":false,"fixedIn":null}],"versionsText":"CS1W-EIP21 V3.04 and earlier | CJ1W-EIP21 V3.04 and earlier","eol":null,"hubHref":"/vendor/omron_corporation/cscj_series_ethernetip_unit"},{"vendor":"omron","product":"cj1w-eip21_firmware","name":"cj1w-eip21 firmware","label":"cj1w-eip21_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 3.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.04","eol":null,"hubHref":"/vendor/omron/cj1w-eip21"},{"vendor":"omron","product":"cj2h-cpu64-eip_firmware","name":"cj2h-cpu64-eip firmware","label":"cj2h-cpu64-eip_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 3.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.04","eol":null,"hubHref":"/vendor/omron/cj2h-cpu64-eip"},{"vendor":"omron","product":"cj2h-cpu65-eip_firmware","name":"cj2h-cpu65-eip firmware","label":"cj2h-cpu65-eip_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 3.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.04","eol":null,"hubHref":"/vendor/omron/cj2h-cpu65-eip"},{"vendor":"omron","product":"cj2h-cpu66-eip_firmware","name":"cj2h-cpu66-eip firmware","label":"cj2h-cpu66-eip_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 3.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.04","eol":null,"hubHref":"/vendor/omron/cj2h-cpu66-eip"},{"vendor":"omron","product":"cj2h-cpu67-eip_firmware","name":"cj2h-cpu67-eip firmware","label":"cj2h-cpu67-eip_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 3.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.04","eol":null,"hubHref":"/vendor/omron/cj2h-cpu67-eip"},{"vendor":"omron","product":"cj2h-cpu68-eip_firmware","name":"cj2h-cpu68-eip firmware","label":"cj2h-cpu68-eip_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 3.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.04","eol":null,"hubHref":"/vendor/omron/cj2h-cpu68-eip"},{"vendor":"omron","product":"cj2m-cpu31_firmware","name":"cj2m-cpu31 firmware","label":"cj2m-cpu31_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 2.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.18","eol":null,"hubHref":"/vendor/omron/cj2m-cpu31"},{"vendor":"omron","product":"cj2m-cpu32_firmware","name":"cj2m-cpu32 firmware","label":"cj2m-cpu32_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 2.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.18","eol":null,"hubHref":"/vendor/omron/cj2m-cpu32"},{"vendor":"omron","product":"cj2m-cpu33_firmware","name":"cj2m-cpu33 firmware","label":"cj2m-cpu33_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 2.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.18","eol":null,"hubHref":"/vendor/omron/cj2m-cpu33"},{"vendor":"omron","product":"cj2m-cpu34_firmware","name":"cj2m-cpu34 firmware","label":"cj2m-cpu34_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 2.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.18","eol":null,"hubHref":"/vendor/omron/cj2m-cpu34"},{"vendor":"omron","product":"cj2m-cpu35_firmware","name":"cj2m-cpu35 firmware","label":"cj2m-cpu35_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 2.18","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.18","eol":null,"hubHref":"/vendor/omron/cj2m-cpu35"},{"vendor":"omron","product":"cs1w-eip21_firmware","name":"cs1w-eip21 firmware","label":"cs1w-eip21_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 3.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.04","eol":null,"hubHref":"/vendor/omron/cs1w-eip21"}],"affectedCount":15,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.ia.omron.com/product/vulnerability/OMSR-2023-006_en.pdf","label":"www.ia.omron.com/product/vulnerability/OMSR-2023-006_en.pdf","hostname":"www.ia.omron.com","tags":["Vendor Advisory"]},{"url":"https://jvn.jp/en/vu/JVNVU92193064/","label":"jvn.jp/en/vu/JVNVU92193064/","hostname":"jvn.jp","tags":["Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-08-03T04:55:52.423Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-10-17T15:17:34.756Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T07:34:03.463Z","stale":false,"partial":false}}