Description
The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.
Published: 2022-07-26
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-52790 The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.
History

No history.

Subscriptions

Omron Nj101-1000 Nj101-1000 Firmware Nj101-1020 Nj101-1020 Firmware Nj101-9000 Nj101-9000 Firmware Nj101-9020 Nj101-9020 Firmware Nj301-1100 Nj301-1100 Firmware Nj301-1200 Nj301-1200 Firmware Nj501-1300 Nj501-1300 Firmware Nj501-1320 Nj501-1320 Firmware Nj501-1340 Nj501-1340 Firmware Nj501-1400 Nj501-1400 Firmware Nj501-1420 Nj501-1420 Firmware Nj501-1500 Nj501-1500 Firmware Nj501-1520 Nj501-1520 Firmware Nj501-4300 Nj501-4300 Firmware Nj501-4320 Nj501-4320 Firmware Nj501-4400 Nj501-4400 Firmware Nj501-4500 Nj501-4500 Firmware Nj501-5300 Nj501-5300-1 Nj501-5300-1 Firmware Nj501-5300 Firmware Nx701-1600 Nx701-1600 Firmware Nx701-1620 Nx701-1620 Firmware Nx701-1700 Nx701-1700 Firmware Nx701-1720 Nx701-1720 Firmware Nx701-z600 Nx701-z600 Firmware Nx701-z700 Nx701-z700 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-03T07:11:39.676Z

Reserved: 2022-05-18T00:00:00.000Z

Link: CVE-2022-31206

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-07-26T22:15:11.400

Modified: 2024-11-21T07:04:07.527

Link: CVE-2022-31206

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses