CVE-2022-31207
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to the PLC. This protocol has authentication flaws as reported in FSCT-2022-0057. Control logic is downloaded to PLC volatile memory using the FINS Program Area Read and Program Area Write commands or to non-volatile memory using other commands from where it can be loaded into volatile memory for execution. The logic that is loaded into and executed from the user program area exists in compiled object code form. Upon execution, these object codes are first passed to a dedicated ASIC that determines whether the object code is to be executed by the ASIC or the microprocessor. In the former case, the object code is interpreted by the ASIC whereas in the latter case the object code is passed to the microprocessor for object code interpretation by a ROM interpreter. In the abnormal case where the object code cannot be handled by either, an abnormal condition is triggered and the PLC is halted. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, thus allowing an attacker to manipulate transmitted object code to the PLC and either execute arbitrary object code commands on the ASIC or on the microprocessor interpreter.
Los PLC de la familia de productos SYSMAC Cx de Omron (series CS, CJ y CP) versiones hasta 18-05-2022, carecen de autenticación criptográfica. Usan el protocolo FINS (9600/TCP) de Omron para fines de ingeniería, incluida la descarga de proyectos y lógica de control al PLC. Este protocolo presenta fallos de autenticación, como es indicado en el documento FSCT-2022-0057. La lógica de control es descargada en la memoria volátil del PLC Usando los comandos FINS Program Area Read y Program Area Write o en la memoria no volátil Usando otros comandos desde donde puede ser cargado en la memoria volátil para su ejecución. La lógica que es cargada y ejecutada desde el área de programa de usuario se presenta en forma de código objeto compilado. Al ejecutarse, estos códigos objeto son pasados primero a un ASIC dedicado que determina si el código objeto debe ser ejecutado por el ASIC o por el microprocesador. En el primer caso, el código objeto es interpretado por el ASIC, mientras que en el segundo caso el código objeto es pasado al microprocesador para que sea interpretado por un intérprete ROM. En el caso anormal en el que el código objeto no puede ser manejado por ninguno de los dos, es desencadenada una condición anormal y el PLC es detenido. La lógica que es descargada en el PLC no parece estar autenticada criptográficamente, lo que permite a un atacante manipular el código objeto transmitido al PLC y ejecutar comandos de código objeto arbitrarios en el ASIC o en el intérprete del microprocesador.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-05-18 CVE Reserved
- 2022-07-26 CVE Published
- 2024-02-16 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-347: Improper Verification of Cryptographic Signature
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02 | Third Party Advisory | |
| https://www.forescout.com/blog | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Omron Search vendor "Omron" | Sysmac Cs1 Firmware Search vendor "Omron" for product "Sysmac Cs1 Firmware" | < 4.1 Search vendor "Omron" for product "Sysmac Cs1 Firmware" and version " < 4.1" | - |
Affected
| in | Omron Search vendor "Omron" | Sysmac Cs1 Search vendor "Omron" for product "Sysmac Cs1" | - | - |
Safe
|
| Omron Search vendor "Omron" | Sysmac Cj2m Firmware Search vendor "Omron" for product "Sysmac Cj2m Firmware" | < 2.1 Search vendor "Omron" for product "Sysmac Cj2m Firmware" and version " < 2.1" | - |
Affected
| in | Omron Search vendor "Omron" | Sysmac Cj2m Search vendor "Omron" for product "Sysmac Cj2m" | - | - |
Safe
|
| Omron Search vendor "Omron" | Sysmac Cj2h Firmware Search vendor "Omron" for product "Sysmac Cj2h Firmware" | < 1.5 Search vendor "Omron" for product "Sysmac Cj2h Firmware" and version " < 1.5" | - |
Affected
| in | Omron Search vendor "Omron" | Sysmac Cj2h Search vendor "Omron" for product "Sysmac Cj2h" | - | - |
Safe
|
| Omron Search vendor "Omron" | Sysmac Cp1e Firmware Search vendor "Omron" for product "Sysmac Cp1e Firmware" | < 1.30 Search vendor "Omron" for product "Sysmac Cp1e Firmware" and version " < 1.30" | - |
Affected
| in | Omron Search vendor "Omron" | Sysmac Cp1e Search vendor "Omron" for product "Sysmac Cp1e" | - | - |
Safe
|
| Omron Search vendor "Omron" | Sysmac Cp1h Firmware Search vendor "Omron" for product "Sysmac Cp1h Firmware" | < 1.30 Search vendor "Omron" for product "Sysmac Cp1h Firmware" and version " < 1.30" | - |
Affected
| in | Omron Search vendor "Omron" | Sysmac Cp1h Search vendor "Omron" for product "Sysmac Cp1h" | - | - |
Safe
|
| Omron Search vendor "Omron" | Sysmac Cp1l Firmware Search vendor "Omron" for product "Sysmac Cp1l Firmware" | < 1.10 Search vendor "Omron" for product "Sysmac Cp1l Firmware" and version " < 1.10" | - |
Affected
| in | Omron Search vendor "Omron" | Sysmac Cp1l Search vendor "Omron" for product "Sysmac Cp1l" | - | - |
Safe
|
| Omron Search vendor "Omron" | Cp1w-cif41 Firmware Search vendor "Omron" for product "Cp1w-cif41 Firmware" | - | - |
Affected
| in | Omron Search vendor "Omron" | Cp1w-cif41 Search vendor "Omron" for product "Cp1w-cif41" | - | - |
Safe
|