{"vulnerability": "CVE-2022-31206", "sightings": [{"uuid": "d20355d6-97d4-4b4d-992d-b702a6cebb07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31206", "type": "seen", "source": "https://t.me/ics_cert/558", "content": "\u06a9\u0634\u0641 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u062f\u0631 \u0628\u0631\u062e\u06cc \u0645\u062d\u0635\u0648\u0644\u0627\u062a \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0635\u0646\u0639\u062a\u06cc Omron\n \u06f1-\n \u0627\u0646\u062a\u0642\u0627\u0644 \u0645\u062a\u0646 \u0634\u0641\u0627\u0641 \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062d\u0633\u0627\u0633 CWE-319\n \u0633\u0631\u06cc Omron SYSMAC CS1/CJ1/CP1/CP2 \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062f\u0646 \u0639\u0645\u0644\u06cc\u0627\u062a \u0645\u0647\u0646\u062f\u0633\u06cc \u06a9\u0647 \u0628\u0647 \u0635\u0648\u0631\u062a \u0645\u062a\u0646 \u0633\u0627\u062f\u0647 \u0645\u0646\u062a\u0642\u0644 \u0645\u06cc \u0634\u0648\u062f \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0627\u0633\u062a.\n CVE-2022-31204 \u0628\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.  \u0646\u0645\u0631\u0647 \u067e\u0627\u06cc\u0647 CVSS v3 6.5 \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.  \u0631\u0634\u062a\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc CVSS (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) \u0627\u0633\u062a.\n\n \u06f2-\n \u0630\u062e\u06cc\u0631\u0647 \u0633\u0627\u0632\u06cc \u0645\u062a\u0646 \u0633\u0627\u062f\u0647 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 CWE-256\n CP1W-CIF41 Ethernet Option Board \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 Web UI \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631 \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u067e\u0631\u0648\u062a\u06a9\u0644 Omron FINS \u0627\u0632 \u062d\u0627\u0641\u0638\u0647 \u062e\u0648\u0627\u0646\u062f\u0647 \u0634\u0648\u062f.  \u0645\u0647\u0627\u062c\u0645\u06cc \u06a9\u0647 \u0627\u06cc\u0646 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u0631\u0627 \u0628\u0647 \u062f\u0633\u062a \u0645\u06cc \u0622\u0648\u0631\u062f \u0645\u06cc \u062a\u0648\u0627\u0646\u062f \u062a\u0646\u0638\u06cc\u0645\u0627\u062a \u0634\u0628\u06a9\u0647 \u06af\u0632\u06cc\u0646\u0647 \u0628\u0631\u062f \u0631\u0627 \u062a\u063a\u06cc\u06cc\u0631 \u062f\u0647\u062f.\n CVE-2022-31205 \u0628\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.  \u0646\u0645\u0631\u0647 \u067e\u0627\u06cc\u0647 CVSS v3 6.5 \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.  \u0631\u0634\u062a\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc CVSS (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) \u0627\u0633\u062a.\n\n \u06f3-\n \u062a\u0623\u06cc\u06cc\u062f \u0646\u0627\u06a9\u0627\u0641\u06cc \u0635\u062d\u062a \u062f\u0627\u062f\u0647 \u0647\u0627 CWE-345\n \u0645\u0646\u0637\u0642\u06cc \u06a9\u0647 \u062f\u0631 PLC \u062f\u0627\u0646\u0644\u0648\u062f \u0645\u06cc\u200c\u0634\u0648\u062f \u0627\u0632 \u0646\u0638\u0631 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0646\u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0628\u062f\u0648\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u062d\u0641\u0627\u0638\u062a\u06cc PLC\u060c \u06a9\u062f \u0634\u06cc \u0645\u0646\u062a\u0642\u0644\u200c\u0634\u062f\u0647 \u0631\u0627 \u0628\u0647 \u06cc\u06a9 PLC \u0645\u062d\u0627\u0641\u0638\u062a\u200c\u0646\u0634\u062f\u0647 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u06a9\u0646\u062f.  \u0633\u067e\u0633 \u06cc\u06a9 \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u06a9\u062f \u0634\u06cc \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0628\u0631 \u0631\u0648\u06cc \u0645\u0646\u0637\u0642 \u0646\u0631\u0645\u200c\u0627\u0641\u0632\u0627\u0631\u06cc \u062a\u0639\u0631\u06cc\u0641\u200c\u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06a9\u0646\u062a\u0631\u0644\u200c\u06a9\u0646\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0633\u0631\u06cc SYSMAC CS/CJ/CP \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f \u0648 \u0634\u0631\u0627\u06cc\u0637 \u0627\u0646\u06a9\u0627\u0631 \u0633\u0631\u0648\u06cc\u0633 \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u062f.\n CVE-2022-31207 \u0628\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.  \u0646\u0645\u0631\u0647 \u067e\u0627\u06cc\u0647 CVSS v3 5.9 \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.  \u0631\u0634\u062a\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc CVSS (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H) \u0627\u0633\u062a.\n\n \u06f4-\n \u062a\u0623\u06cc\u06cc\u062f \u0646\u0627\u06a9\u0627\u0641\u06cc \u0635\u062d\u062a \u062f\u0627\u062f\u0647 \u0647\u0627 CWE-347\n \u0645\u0646\u0637\u0642\u06cc \u06a9\u0647 \u062f\u0631 PLC \u062f\u0627\u0646\u0644\u0648\u062f \u0645\u06cc\u200c\u0634\u0648\u062f \u0627\u0632 \u0646\u0638\u0631 \u0631\u0645\u0632\u0646\u06af\u0627\u0631\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0646\u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0648 \u0628\u0647 \u0645\u0647\u0627\u062c\u0645 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u062f \u0634\u06cc \u0645\u0646\u062a\u0642\u0644 \u0634\u062f\u0647 \u0628\u0647 PLC \u0631\u0627 \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u06a9\u0646\u062f \u0648 \u06a9\u062f \u0645\u0627\u0634\u06cc\u0646 \u062f\u0644\u062e\u0648\u0627\u0647 \u0631\u0627 \u0631\u0648\u06cc \u067e\u0631\u062f\u0627\u0632\u0646\u062f\u0647 \u0645\u0627\u0698\u0648\u0644 CPU PLC \u0628\u0631\u0627\u06cc \u06a9\u0646\u062a\u0631\u0644\u200c\u06a9\u0646\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u0633\u0631\u06cc SYSMAC NJ/NX \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f.\n CVE-2022-31206 \u0628\u0647 \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.  \u0646\u0645\u0631\u0647 \u067e\u0627\u06cc\u0647 CVSS v3 4.4 \u0627\u062e\u062a\u0635\u0627\u0635 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.  \u0631\u0634\u062a\u0647 \u0628\u0631\u062f\u0627\u0631\u06cc CVSS (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) \u0627\u0633\u062a.\n\n\ud83d\udc6e\u200d\u2640\ufe0f\ud83d\udc6e\u200d\u2640\ufe0f \u0628\u0627\u0632\u0646\u0634\u0631 \u0645\u0637\u0627\u0644\u0628 \u0627\u06cc\u0646 \u06a9\u0627\u0646\u0627\u0644 \u0635\u0631\u0641\u0627 \u0628\u0627 \u0630\u06a9\u0631 \u0645\u0646\u0628\u0639 \u0648 \u0622\u062f\u0631\u0633 \u06a9\u0627\u0645\u0644 \u06a9\u0627\u0646\u0627\u0644 \u0645\u062c\u0627\u0632 \u0645\u06cc\u0628\u0627\u0634\u062f.\n\n\ud83c\udfed\u0648\u0628\u0633\u0627\u06cc\u062a \u0648 \u06a9\u0627\u0646\u0627\u0644 \u062a\u062e\u0635\u0635\u06cc \u0627\u0645\u0646\u06cc\u062a \u0632\u06cc\u0631\u0633\u0627\u062e\u062a\u0647\u0627\u06cc \u0627\u062a\u0648\u0645\u0627\u0633\u06cc\u0648\u0646 \u0648 \u06a9\u0646\u062a\u0631\u0644 \u0635\u0646\u0639\u062a\u06cc\n\n\u0627\u062f\u0645\u06cc\u0646:\nhttps://t.me/pedram_kiani\n\u06a9\u0627\u0646\u0627\u0644 \u062a\u0644\u06af\u0631\u0627\u0645:\nhttps://t.me/ics_cert\n\u062a\u0648\u06cc\u06cc\u062a\u0631:\nhttps://twitter.com/icscerti", "creation_timestamp": "2022-06-29T16:55:26.000000Z"}, {"uuid": "97f935a5-9efd-44bc-9cc9-6fe476b85a48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31206", "type": "seen", "source": "https://t.me/cibsecurity/47037", "content": "\u203c CVE-2022-31206 \u203c\n\nThe Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-06-07T14:45:52.000000Z"}]}