Detections
Analytics

Omron SYSMAC CS/CJ/CP Series and NJ/NX Series Plaintext Storage of a Password (CVE-2022-31205)

high Tenable OT Security Plugin ID 501148

Synopsis

The remote OT asset is affected by a vulnerability.

Description

In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

 For CVE-2022-31204: Omron recommends users implement an extended password protection function in the following product versions:

- CS1, v.4.1 or later
- CJ2M, v2.1 or later
- CJ2H, v1.5 or later
- CP1E/CP1H , v1.30 or later
- CP1L, v1.10 or later
- CX-Programmer, v9.6 or higher

For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.

For CVE-2022-31207: Omron recommends users of SYSMAC CS/CJ/CP Series to use the PLC protection password and enable protection against unauthorized write access to address. Also, there are hardware DIP switches on the PLC which can prevent unauthorized PLC program changes regardless of password.

For CVE-2022-31205: Omron recommends using different passwords between the CP1W-CIF41 Ethernet Option Board and CP1 PLC itself. The Web UI password will not grant access to the PLC.

See Also

https://www.forescout.com/blog/

https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02

Plugin Details

Severity: High

ID: 501148

Version: 1.7

Type: remote

Family: Tenable.ot

Published: 5/22/2023

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2022-31205

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:omron:sysmac_cp1h_firmware, cpe:/o:omron:sysmac_cp1l_firmware, cpe:/o:omron:sysmac_cp1e_firmware

Required KB Items: Tenable.ot/Omron

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2022

Vulnerability Publication Date: 7/26/2022

Reference Information

CVE: CVE-2022-31205

CWE: 522

ICSA: 22-179-02