Omron SYSMAC CS/CJ/CP Series and NJ/NX Series Improper Verification of Cryptographic Signature (CVE-2022-31206)

critical Tenable OT Security Plugin ID 501150

Synopsis

The remote OT asset is affected by a vulnerability.

Description

The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

For CVE-2022-31204: Omron recommends users implement an extended password protection function in the following product versions:

- CS1, v.4.1 or later
- CJ2M, v2.1 or later
- CJ2H, v1.5 or later
- CP1E/CP1H , v1.30 or later
- CP1L, v1.10 or later
- CX-Programmer, v9.6 or higher

For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.

For CVE-2022-31207: Omron recommends users of SYSMAC CS/CJ/CP Series to use the PLC protection password and enable protection against unauthorized write access to address. Also, there are hardware DIP switches on the PLC which can prevent unauthorized PLC program changes regardless of password.

For CVE-2022-31205: Omron recommends using different passwords between the CP1W-CIF41 Ethernet Option Board and CP1 PLC itself. The Web UI password will not grant access to the PLC.

Plugin Details

Severity: Critical

ID: 501150

Version: 1.5

Type: remote

Family: Tenable.ot

Published: 5/22/2023

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-31206

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:omron:nx701-z700_firmware, cpe:/o:omron:nj501-4300_firmware, cpe:/o:omron:nj501-1520_firmware, cpe:/o:omron:nj501-4500_firmware, cpe:/o:omron:nj501-5300_firmware, cpe:/o:omron:nj501-1340_firmware, cpe:/o:omron:nx701-z600_firmware, cpe:/o:omron:nj501-1320_firmware, cpe:/o:omron:nj101-9020_firmware, cpe:/o:omron:nj501-1400_firmware, cpe:/o:omron:nj501-5300-1_firmware, cpe:/o:omron:nj101-1020_firmware, cpe:/o:omron:nj501-4400_firmware, cpe:/o:omron:nj501-1500_firmware, cpe:/o:omron:nj301-1100_firmware, cpe:/o:omron:nx701-1600_firmware, cpe:/o:omron:nj301-1200_firmware, cpe:/o:omron:nj501-1420_firmware, cpe:/o:omron:nx701-1700_firmware, cpe:/o:omron:nx701-1620_firmware, cpe:/o:omron:nx701-1720_firmware, cpe:/o:omron:nj101-9000_firmware, cpe:/o:omron:nj501-1300_firmware, cpe:/o:omron:nj501-4320_firmware, cpe:/o:omron:nj101-1000_firmware

Required KB Items: Tenable.ot/Omron

Exploit Ease: No known exploits are available

Patch Publication Date: 7/26/2022

Vulnerability Publication Date: 7/26/2022

Reference Information

CVE: CVE-2022-31206

CWE: 347

ICSA: 22-179-02

Detections

Analytics