CVE-2022-2979 - OpenCVE

Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Omron	Cx-programmer

Configuration 1 [-]

cpe:2.3:a:omron:cx-programmer:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-09

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-09-12T19:24:03.386703Z

Updated: 2024-09-17T02:37:34.673Z

Reserved: 2022-08-24T00:00:00

Link: CVE-2022-2979

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-09-12T21:15:10.230

Modified: 2022-09-15T19:27:21.957

Link: CVE-2022-2979

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "CX-Programmer", "vendor": "Omron", "versions": [{"lessThan": "v9.78", "status": "affected", "version": "All", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "xina1i, working with Trend Micro\u2019s Zero Day Initiative, reported this vulnerability to CISA."}], "datePublic": "2022-08-30T00:00:00", "descriptions": [{"lang": "en", "value": "Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-12T19:24:03", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-09"}], "solutions": [{"lang": "en", "value": "Omron recommends updating to the latest version:\n\nOmron CX-Programmer: Update to v9.78\nShould assistance be needed for the update process, users should contact Omron. \n\nOmron provides additional mitigations to reduce the risk:\n\nUse antivirus protection by protecting any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade antivirus software protection.\nUse strong passwords and change them frequently.\nInstall physical controls, allowing only authorized personnel access to control systems and equipment.\nPerform virus scans to ensure safety of any USB drives or similar devices before connecting to systems and devices.\nEnforce multifactor authentication on all devices with remote access to control systems and equipment whenever possible.\nPerform validation processing, such as backup and range checks, to cope with unintentional modification of input/output data to control systems and devices.\nPerform periodic data backup and maintenance to prepare for data loss."}], "source": {"advisory": "ICSA-22-242-09", "discovery": "EXTERNAL"}, "title": "Omron CX-Programmer", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2022-08-30T17:00:00.000Z", "ID": "CVE-2022-2979", "STATE": "PUBLIC", "TITLE": "Omron CX-Programmer"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "CX-Programmer", "version": {"version_data": [{"version_affected": "<", "version_name": "All", "version_value": "v9.78"}]}}]}, "vendor_name": "Omron"}]}}, "credit": [{"lang": "eng", "value": "xina1i, working with Trend Micro\u2019s Zero Day Initiative, reported this vulnerability to CISA."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-416 Use After Free"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-09", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-09"}]}, "solution": [{"lang": "en", "value": "Omron recommends updating to the latest version:\n\nOmron CX-Programmer: Update to v9.78\nShould assistance be needed for the update process, users should contact Omron. \n\nOmron provides additional mitigations to reduce the risk:\n\nUse antivirus protection by protecting any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade antivirus software protection.\nUse strong passwords and change them frequently.\nInstall physical controls, allowing only authorized personnel access to control systems and equipment.\nPerform virus scans to ensure safety of any USB drives or similar devices before connecting to systems and devices.\nEnforce multifactor authentication on all devices with remote access to control systems and equipment whenever possible.\nPerform validation processing, such as backup and range checks, to cope with unintentional modification of input/output data to control systems and devices.\nPerform periodic data backup and maintenance to prepare for data loss."}], "source": {"advisory": "ICSA-22-242-09", "discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:53:00.516Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-09"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-2979", "datePublished": "2022-09-12T19:24:03.386703Z", "dateReserved": "2022-08-24T00:00:00", "dateUpdated": "2024-09-17T02:37:34.673Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}