Paper/Archive/CVE-2023-0811

CVE-2023-0811

Omron CJ1M SYSMAC CJ-series — Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored.

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD, CNA agree)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 49.8.498 × 2010.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.

Affected

ProductAffectedFixed inSource

CJ1M SYSMAC CJ-seriesAll versions –CNA

CJ1M SYSMAC CS-seriesAll versions –CNA

CJ1M SYSMAC CP-seriesAll versions –CNA

Scores by source

icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcisa.gov/news-events/ics-advisories/icsa-23-073-01 refia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf