Omron SYSMAC CS/CJ/CP Series and NJ/NX Series
Omron SYSMAC CS1/CJ1/CP1/CP2 series is vulnerable to a password used to restrict engineering operation is transmitted in plaintext. CVE-2022-31204 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The CP1W-CIF41 Ethernet Option Board is vulnerable to a Web UI password that can be read from memory using the Omron FINS protocol. An attacker obtaining this password could change the network settings of the option board. CVE-2022-31205 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The logic that is downloaded to the PLC is not cryptographically authenticated, allowing an attacker to manipulate transmitted object code to an unprotected PLC without using the PLC protection password. An attacker could then execute arbitrary object code commands on the defined software logic for all versions of SYSMAC CS/CJ/CP series controllers and cause a denial-of-service condition. CVE-2022-31207 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H). The logic that is downloaded to the PLC is not cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module for SYSMAC NJ/NX series controllers. CVE-2022-31206 has been assigned to this vulnerability. A CVSS v3 base score of 4.4 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N).