CVE-2022-31206
criticalPriorität · verfolgen · 39OT-Risiko · erhöhtEPSS 0.011 · 66. PerzentilEURUUSEPSS · bewertet 2026-10-27
The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationCP1W-CIF41cisa_csaf_ot
For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.
- MitigationSYSMAC CJ2Hcisa_csaf_ot
For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.
- MitigationSYSMAC CJ2Mcisa_csaf_ot
For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.
- MitigationSYSMAC CP1E/CP1Hcisa_csaf_ot
For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.
- MitigationSYSMAC CP1Lcisa_csaf_ot
For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.
- MitigationSYSMAC CS1H/CJ1Gcisa_csaf_ot
For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.
- MitigationSYSMAC CX-Programmercisa_csaf_ot
For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.
- MitigationSYSMAC NJ/NX Seriescisa_csaf_ot
For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 4.4–9.8
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (43)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-22-179-02Omron SYSMAC CS/CJ/CP Series and NJ/NX Series2022-06-28icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could cause a denial-of-service condition and allow remote code execution.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2022-31206/cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-22-179-02cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.3140cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022062924cnnvd
- https://www.forescout.com/blog/cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02enisa_euvd
- https://www.forescout.com/blog/enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan