Omron CJ1M PLC Improper Access Control (CVE-2023-0811)

critical Tenable OT Security Plugin ID 501151

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

OMRON has released the following countermeasures for users to implement:

- Enable the hardware switch to prohibit writing UM (DIP switch on front panel of the CPU Unit)
- Set UM read protection password and “Prohibit from overwriting to a protected program “option.

If the countermeasures cannot be applied, OMRON recommends that customers take the following mitigation measures:

Security measures to prevent unauthorized access:

- If the following products and versions are used, the risk of attacks by an attacker via the network can be reduced by taking the following measures.
- Enable the FINS write protection function.
- Select the Protect by IP Address
- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.
- Implement firewalls (by shutting down unused communications ports, limiting communications hosts, limiting access to FINS port (9600)) and isolate them from the IT network.
- Use a virtual private network (VPN) for remote access to control systems and equipment.
- Use strong passwords and change them frequently.
- Install physical controls so that only authorized personnel can access control systems and equipment.
- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.
- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.
- Anti-virus protection
- Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to- date commercial grade anti-virus software protection.
- Data input and output protection
- Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.
- Data recovery
- Periodical data backup and maintenance to prepare for data loss.

For more information, see Omron’s Security Advisory.

Plugin Details

Severity: Critical

ID: 501151

Version: 1.5

Type: remote

Family: Tenable.ot

Published: 5/22/2023

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.2

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2023-0811

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:omron:sysmac_cp1e-e10dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-em40dt-d_firmware:-, cpe:/o:omron:sysmac_cp1e-na20dr-a_firmware:-, cpe:/o:omron:sysmac_cp1h-x40dt-d_firmware:-, cpe:/o:omron:sysmac_cp1l-l14dr-d_firmware:-, cpe:/o:omron:sysmac_cp1l-m30dr-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n14dt1-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n40dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n20dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-l14dt-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m60dr-d_firmware:-, cpe:/o:omron:sysmac_cp1l-m60dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-l20dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-em40dr-d_firmware:-, cpe:/o:omron:sysmac_cp1l-m30dt-a_firmware:-, cpe:/o:omron:sysmac_cp1l-em40dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1e-e14sdr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n14dt-a_firmware:-, cpe:/o:omron:sysmac_cp1e-e20dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n30dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m40dt-d_firmware:-, cpe:/o:omron:sysmac_cp1l-m60dt-d_firmware:-, cpe:/o:omron:sysmac_cp1e-e20sdr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-l14dt-d_firmware:-, cpe:/o:omron:sysmac_cp1h-y20dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n30dt1-d_firmware:-, cpe:/o:omron:sysmac_cp2e-s60dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n40dt-a_firmware:-, cpe:/o:omron:sysmac_cp1e-e10dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-s40dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1e-e10dt-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m60dt-a_firmware:-, cpe:/o:omron:sysmac_cp1e-e40sdr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m30dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-e60dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n60dr-d_firmware:-, cpe:/o:omron:sysmac_cs1w-nc%5b%5d71_firmware:-, cpe:/o:omron:sysmac_cp2e-s60dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1e-e40dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-l14dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n30dt-a_firmware:-, cpe:/o:omron:sysmac_cp1e-na20dt-d_firmware:-, cpe:/o:omron:sysmac_cp1l-em30dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n20dt-a_firmware:-, cpe:/o:omron:sysmac_cs1w-spu02-v2_firmware:-, cpe:/o:omron:sysmac_cp2e-n60dt-a_firmware:-, cpe:/o:omron:sysmac_cp1l-l10dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1e-e30sdr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-e40dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-s30dr-a_firmware:-, cpe:/o:omron:sysmac_cp1e-e14dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-e30dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n30dt-d_firmware:-, cpe:/o:omron:sysmac_cp1h-x40dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1e-e10dt-d_firmware:-, cpe:/o:omron:sysmac_cp1l-l10dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n60dr-a_firmware:-, cpe:/o:omron:sysmac_cs1w-fln22_firmware:-, cpe:/o:omron:sysmac_cp1l-l20dt-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m40dr-d_firmware:-, cpe:/o:omron:sysmac_cp1l-l10dt-a_firmware:-, cpe:/o:omron:sysmac_cp2e-e14dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m30dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n30dr-d_firmware:-, cpe:/o:omron:sysmac_cp2e-s30dt1-d_firmware:-, cpe:/o:omron:sysmac_cp2e-s40dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-l20dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n14dt-d_firmware:-, cpe:/o:omron:sysmac_cs1w-drm21-v1_firmware:-, cpe:/o:omron:sysmac_cp1l-l20dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-s60dr-a_firmware:-, cpe:/o:omron:sysmac_cp1e-e10dr-d_firmware:-, cpe:/o:omron:sysmac_cp2e-s30dt-d_firmware:-, cpe:/o:omron:sysmac_cs1w-spu01-v2_firmware:-, cpe:/o:omron:sysmac_cp1h-xa40dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-l14dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-l20dr-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n40dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-m60dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n40dr-d_firmware:-, cpe:/o:omron:sysmac_cp1l-el20dr-d_firmware:-, cpe:/o:omron:sysmac_cp1h-x40dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m40dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-m30dt1-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n40dr-a_firmware:-, cpe:/o:omron:sysmac_cp2e-n20dt-d_firmware:-, cpe:/o:omron:sysmac_cp1e-e60sdr-a_firmware:-, cpe:/o:omron:sysmac_cp1h-xa40dt1-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n20dr-d_firmware:-, cpe:/o:omron:sysmac_cp2e-s40dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n14dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-em30dt1-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n60dt-d_firmware:-, cpe:/o:omron:sysmac_cp2e-n20dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-em30dr-d_firmware:-, cpe:/o:omron:sysmac_cs1w-etn21_firmware:-, cpe:/o:omron:sysmac_cp2e-n14dr-d_firmware:-, cpe:/o:omron:sysmac_cp1h-xa40dt-d_firmware:-, cpe:/o:omron:sysmac_cp1e-na20dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-l10dr-d_firmware:-, cpe:/o:omron:sysmac_cp2e-e20dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m40dr-a_firmware:-, cpe:/o:omron:sysmac_cp1l-m40dt-a_firmware:-, cpe:/o:omron:sysmac_cs1w-eip21_firmware:-, cpe:/o:omron:sysmac_cp2e-n60dt1-d_firmware:-, cpe:/o:omron:sysmac_cp1l-l10dr-a_firmware:-, cpe:/o:omron:sysmac_cp1e-e10dt1-a_firmware:-, cpe:/o:omron:sysmac_cp1e-e30dr-a_firmware:-

Required KB Items: Tenable.ot/Omron

Exploit Ease: No known exploits are available

Patch Publication Date: 3/16/2023

Vulnerability Publication Date: 3/16/2023

Reference Information

CVE: CVE-2023-0811

CWE: 284

ICSA: 23-073-01

Detections

Analytics