Vulnerability-Lookup

GHSA-XMM9-HRFR-PPHF

Vulnerability from github – Published: 2023-03-16 18:30 – Updated: 2023-03-28 18:30

Details

Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.

Severity

9.1 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-0811"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-16T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.",
  "id": "GHSA-xmm9-hrfr-pphf",
  "modified": "2023-03-28T18:30:30Z",
  "published": "2023-03-16T18:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0811"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-01"
    },
    {
      "type": "WEB",
      "url": "https://www.ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2023-0811 (GCVE-0-2023-0811)

Vulnerability from cvelistv5 – Published: 2023-03-16 17:41 – Updated: 2025-01-16 21:42

Summary

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-284 - Improper Access Control

Assigner

icscert

References

2 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
https://www.ia.omron.com/product/vulnerability/OM…

Impacted products

5 products

Vendor	Product	Version
Omron	CJ1M SYSMAC CJ-series	Affected: All versions
Omron	CJ1M SYSMAC CJ-series	Affected: All versions
Omron	CJ1M SYSMAC CS-series	Affected: All versions
Omron	CJ1M SYSMAC CS-series	Affected: All versions
Omron	CJ1M SYSMAC CP-series	Affected: All versions

Credits

Sam Hanson of Dragos reported these vulnerabilities to CISA.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:24:34.505Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0811",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-16T20:56:16.921497Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-16T21:42:32.824Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "CJ2H-CPU6 \u25a1 -EIP",
          "product": "CJ1M SYSMAC CJ-series",
          "vendor": "Omron ",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CJ2H-CPU6 \u25a1",
          "product": "CJ1M SYSMAC CJ-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CJ2M-CPU \u25a1 \u25a1",
          "product": "CJ1M SYSMAC CJ-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CJ1G-CPU \u25a1 \u25a1 P",
          "product": "CJ1M SYSMAC CJ-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CS1H-CPU \u25a1 \u25a1 H",
          "product": "CJ1M SYSMAC CS-series ",
          "vendor": "Omron ",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CS1G-CPU \u25a1 \u25a1 H",
          "product": "CJ1M SYSMAC CS-series ",
          "vendor": "Omron ",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CS1D-CPU \u25a1 \u25a1 HA",
          "product": "CJ1M SYSMAC CS-series ",
          "vendor": "Omron ",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CS1D-CPU \u25a1 \u25a1 H",
          "product": "CJ1M SYSMAC CS-series ",
          "vendor": "Omron ",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CS1D-CPU \u25a1 \u25a1 SA",
          "product": "CJ1M SYSMAC CS-series ",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CS1D-CPU \u25a1 \u25a1 S",
          "product": "CJ1M SYSMAC CS-series ",
          "vendor": "Omron ",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CS1D-CPU \u25a1 \u25a1 P",
          "product": "CJ1M SYSMAC CS-series ",
          "vendor": "Omron ",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP2E-E \u25a1 \u25a1 D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP2E-S \u25a1 \u25a1 D \u25a1- \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP2E-N \u25a1 \u25a1 D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1H-X40D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1H-XA40D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1H-Y20DT-D",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1L-EL20D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1L-EM \u25a1 \u25a1 D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1L-L \u25a1 \u25a1 D \u25a1- \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1L-M \u25a1 \u25a1 D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1E-E \u25a1 \u25a1 D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageName": "CP1E-NA \u25a1 \u25a1 D \u25a1 - \u25a1",
          "product": "CJ1M SYSMAC CP-series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "All versions "
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Sam Hanson of Dragos reported these vulnerabilities to CISA. "
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eOmron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program. \u003c/span\u003e\n\n"
            }
          ],
          "value": "\nOmron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program. \n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control ",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-03-16T17:45:14.919Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-01"
        },
        {
          "url": "https://www.ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cp\u003eOMRON has released the following countermeasures for users to implement: \u003c/p\u003e\u003cul\u003e\u003cli\u003eEnable the hardware switch to prohibit writing UM (DIP switch on front panel of the CPU Unit) \u003c/li\u003e\u003cli\u003eSet UM read protection password and \u201cProhibit from overwriting to a protected program \u201coption. \u003c/li\u003e\u003c/ul\u003e\u003cp\u003eIf the countermeasures cannot be applied, OMRON recommends that customers take the following mitigation measures: \u003c/p\u003e\u003cp\u003eSecurity measures to prevent unauthorized access: \u003c/p\u003e\u003cul\u003e\u003cli\u003eIf the following products and versions are used, the risk of attacks by an attacker via the network can be reduced by taking the following measures. \u003cul\u003e\u003cli\u003eEnable the FINS write protection function. \u003c/li\u003e\u003cli\u003eSelect the Protect by IP Address \u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eMinimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them. \u0026nbsp;\u003c/li\u003e\u003cli\u003eImplement firewalls (by shutting down unused communications ports, limiting communications hosts, limiting access to FINS port (9600)) and isolate them from the IT network. \u003c/li\u003e\u003cli\u003eUse a virtual private network (VPN) for remote access to control systems and equipment. \u003c/li\u003e\u003cli\u003eUse strong passwords and change them frequently. \u003c/li\u003e\u003cli\u003eInstall physical controls so that only authorized personnel can access control systems and equipment. \u003c/li\u003e\u003cli\u003eScan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices. \u003c/li\u003e\u003cli\u003eEnforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible. \u003c/li\u003e\u003cli\u003eAnti-virus protection \u003cul\u003e\u003cli\u003eProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection. \u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eData input and output protection \u003cul\u003e\u003cli\u003eValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices. \u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003cli\u003eData recovery \u003cul\u003e\u003cli\u003ePeriodical data backup and maintenance to prepare for data loss. \u003c/li\u003e\u003c/ul\u003e\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor more information, see Omron\u2019s \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf\"\u003eSecurity Advisory\u003c/a\u003e.\u003c/p\u003e\u003cbr\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nOMRON has released the following countermeasures for users to implement: \n\n  *  Enable the hardware switch to prohibit writing UM (DIP switch on front panel of the CPU Unit) \n  *  Set UM read protection password and \u201cProhibit from overwriting to a protected program \u201coption. \n\n\nIf the countermeasures cannot be applied, OMRON recommends that customers take the following mitigation measures: \n\nSecurity measures to prevent unauthorized access: \n\n  *  If the following products and versions are used, the risk of attacks by an attacker via the network can be reduced by taking the following measures.   *  Enable the FINS write protection function. \n  *  Select the Protect by IP Address \n\n\n\n  *  Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them. \u00a0\n  *  Implement firewalls (by shutting down unused communications ports, limiting communications hosts, limiting access to FINS port (9600)) and isolate them from the IT network. \n  *  Use a virtual private network (VPN) for remote access to control systems and equipment. \n  *  Use strong passwords and change them frequently. \n  *  Install physical controls so that only authorized personnel can access control systems and equipment. \n  *  Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices. \n  *  Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible. \n  *  Anti-virus protection   *  Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection. \n\n\n\n  *  Data input and output protection   *  Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices. \n\n\n\n  *  Data recovery   *  Periodical data backup and maintenance to prepare for data loss. \n\n\n\n\n\nFor more information, see Omron\u2019s  Security Advisory https://www.ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf .\n\n\n\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2023-0811",
    "datePublished": "2023-03-16T17:41:25.525Z",
    "dateReserved": "2023-02-13T15:41:55.590Z",
    "dateUpdated": "2025-01-16T21:42:32.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-XMM9-HRFR-PPHF

CVE-2023-0811 (GCVE-0-2023-0811)

Tags

Sightings

Nomenclature