Description

Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.

Published: 2023-03-16
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Workaround

OMRON has released the following countermeasures for users to implement: * Enable the hardware switch to prohibit writing UM (DIP switch on front panel of the CPU Unit) * Set UM read protection password and “Prohibit from overwriting to a protected program “option. If the countermeasures cannot be applied, OMRON recommends that customers take the following mitigation measures: Security measures to prevent unauthorized access: * If the following products and versions are used, the risk of attacks by an attacker via the network can be reduced by taking the following measures. * Enable the FINS write protection function. * Select the Protect by IP Address * Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.   * Implement firewalls (by shutting down unused communications ports, limiting communications hosts, limiting access to FINS port (9600)) and isolate them from the IT network. * Use a virtual private network (VPN) for remote access to control systems and equipment. * Use strong passwords and change them frequently. * Install physical controls so that only authorized personnel can access control systems and equipment. * Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices. * Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible. * Anti-virus protection * Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection. * Data input and output protection * Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices. * Data recovery * Periodical data backup and maintenance to prepare for data loss. For more information, see Omron’s Security Advisory https://www.ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf .

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-12816 Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.
History

Thu, 16 Jan 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Subscriptions

Omron Sysmac Cj2h-cpu64 Sysmac Cj2h-cpu64-eip Sysmac Cj2h-cpu64-eip Firmware Sysmac Cj2h-cpu64 Firmware Sysmac Cj2h-cpu65 Sysmac Cj2h-cpu65-eip Sysmac Cj2h-cpu65-eip Firmware Sysmac Cj2h-cpu65 Firmware Sysmac Cj2h-cpu66 Sysmac Cj2h-cpu66-eip Sysmac Cj2h-cpu66-eip Firmware Sysmac Cj2h-cpu66 Firmware Sysmac Cj2h-cpu67 Sysmac Cj2h-cpu67-eip Sysmac Cj2h-cpu67-eip Firmware Sysmac Cj2h-cpu67 Firmware Sysmac Cj2h-cpu68 Sysmac Cj2h-cpu68-eip Sysmac Cj2h-cpu68-eip Firmware Sysmac Cj2h-cpu68 Firmware Sysmac Cj2m-cpu11 Sysmac Cj2m-cpu11 Firmware Sysmac Cj2m-cpu12 Sysmac Cj2m-cpu12 Firmware Sysmac Cj2m-cpu13 Sysmac Cj2m-cpu13 Firmware Sysmac Cj2m-cpu14 Sysmac Cj2m-cpu14 Firmware Sysmac Cj2m-cpu15 Sysmac Cj2m-cpu15 Firmware Sysmac Cj2m-cpu31 Sysmac Cj2m-cpu31 Firmware Sysmac Cj2m-cpu32 Sysmac Cj2m-cpu32 Firmware Sysmac Cj2m-cpu33 Sysmac Cj2m-cpu33 Firmware Sysmac Cj2m-cpu34 Sysmac Cj2m-cpu34 Firmware Sysmac Cj2m-cpu35 Sysmac Cj2m-cpu35 Firmware Sysmac Cp1e-e10dr-a Sysmac Cp1e-e10dr-a Firmware Sysmac Cp1e-e10dr-d Sysmac Cp1e-e10dr-d Firmware Sysmac Cp1e-e10dt-a Sysmac Cp1e-e10dt-a Firmware Sysmac Cp1e-e10dt-d Sysmac Cp1e-e10dt-d Firmware Sysmac Cp1e-e10dt1-a Sysmac Cp1e-e10dt1-a Firmware Sysmac Cp1e-e10dt1-d Sysmac Cp1e-e10dt1-d Firmware Sysmac Cp1e-e14dr-a Sysmac Cp1e-e14dr-a Firmware Sysmac Cp1e-e14sdr-a Sysmac Cp1e-e14sdr-a Firmware Sysmac Cp1e-e20dr-a Sysmac Cp1e-e20dr-a Firmware Sysmac Cp1e-e20sdr-a Sysmac Cp1e-e20sdr-a Firmware Sysmac Cp1e-e30dr-a Sysmac Cp1e-e30dr-a Firmware Sysmac Cp1e-e30sdr-a Sysmac Cp1e-e30sdr-a Firmware Sysmac Cp1e-e40dr-a Sysmac Cp1e-e40dr-a Firmware Sysmac Cp1e-e40sdr-a Sysmac Cp1e-e40sdr-a Firmware Sysmac Cp1e-e60sdr-a Sysmac Cp1e-e60sdr-a Firmware Sysmac Cp1e-na20dr-a Sysmac Cp1e-na20dr-a Firmware Sysmac Cp1e-na20dt-d Sysmac Cp1e-na20dt-d Firmware Sysmac Cp1e-na20dt1-d Sysmac Cp1e-na20dt1-d Firmware Sysmac Cp1h-x40dr-a Sysmac Cp1h-x40dr-a Firmware Sysmac Cp1h-x40dt-d Sysmac Cp1h-x40dt-d Firmware Sysmac Cp1h-x40dt1-d Sysmac Cp1h-x40dt1-d Firmware Sysmac Cp1h-xa40dr-a Sysmac Cp1h-xa40dr-a Firmware Sysmac Cp1h-xa40dt-d Sysmac Cp1h-xa40dt-d Firmware Sysmac Cp1h-xa40dt1-d Sysmac Cp1h-xa40dt1-d Firmware Sysmac Cp1h-y20dt-d Sysmac Cp1h-y20dt-d Firmware Sysmac Cp1l-el20dr-d Sysmac Cp1l-el20dr-d Firmware Sysmac Cp1l-em30dr-d Sysmac Cp1l-em30dr-d Firmware Sysmac Cp1l-em30dt-d Sysmac Cp1l-em30dt-d Firmware Sysmac Cp1l-em30dt1-d Sysmac Cp1l-em30dt1-d Firmware Sysmac Cp1l-em40dr-d Sysmac Cp1l-em40dr-d Firmware Sysmac Cp1l-em40dt-d Sysmac Cp1l-em40dt-d Firmware Sysmac Cp1l-em40dt1-d Sysmac Cp1l-em40dt1-d Firmware Sysmac Cp1l-l10dr-a Sysmac Cp1l-l10dr-a Firmware Sysmac Cp1l-l10dr-d Sysmac Cp1l-l10dr-d Firmware Sysmac Cp1l-l10dt-a Sysmac Cp1l-l10dt-a Firmware Sysmac Cp1l-l10dt-d Sysmac Cp1l-l10dt-d Firmware Sysmac Cp1l-l10dt1-d Sysmac Cp1l-l10dt1-d Firmware Sysmac Cp1l-l14dr-a Sysmac Cp1l-l14dr-a Firmware Sysmac Cp1l-l14dr-d Sysmac Cp1l-l14dr-d Firmware Sysmac Cp1l-l14dt-a Sysmac Cp1l-l14dt-a Firmware Sysmac Cp1l-l14dt-d Sysmac Cp1l-l14dt-d Firmware Sysmac Cp1l-l14dt1-d Sysmac Cp1l-l14dt1-d Firmware Sysmac Cp1l-l20dr-a Sysmac Cp1l-l20dr-a Firmware Sysmac Cp1l-l20dr-d Sysmac Cp1l-l20dr-d Firmware Sysmac Cp1l-l20dt-a Sysmac Cp1l-l20dt-a Firmware Sysmac Cp1l-l20dt-d Sysmac Cp1l-l20dt-d Firmware Sysmac Cp1l-l20dt1-d Sysmac Cp1l-l20dt1-d Firmware Sysmac Cp1l-m30dr-a Sysmac Cp1l-m30dr-a Firmware Sysmac Cp1l-m30dr-d Sysmac Cp1l-m30dr-d Firmware Sysmac Cp1l-m30dt-a Sysmac Cp1l-m30dt-a Firmware Sysmac Cp1l-m30dt-d Sysmac Cp1l-m30dt-d Firmware Sysmac Cp1l-m30dt1-d Sysmac Cp1l-m30dt1-d Firmware Sysmac Cp1l-m40dr-a Sysmac Cp1l-m40dr-a Firmware Sysmac Cp1l-m40dr-d Sysmac Cp1l-m40dr-d Firmware Sysmac Cp1l-m40dt-a Sysmac Cp1l-m40dt-a Firmware Sysmac Cp1l-m40dt-d Sysmac Cp1l-m40dt-d Firmware Sysmac Cp1l-m40dt1-d Sysmac Cp1l-m40dt1-d Firmware Sysmac Cp1l-m60dr-a Sysmac Cp1l-m60dr-a Firmware Sysmac Cp1l-m60dr-d Sysmac Cp1l-m60dr-d Firmware Sysmac Cp1l-m60dt-a Sysmac Cp1l-m60dt-a Firmware Sysmac Cp1l-m60dt-d Sysmac Cp1l-m60dt-d Firmware Sysmac Cp1l-m60dt1-d Sysmac Cp1l-m60dt1-d Firmware Sysmac Cp2e-e14dr-a Sysmac Cp2e-e14dr-a Firmware Sysmac Cp2e-e20dr-a Sysmac Cp2e-e20dr-a Firmware Sysmac Cp2e-e30dr-a Sysmac Cp2e-e30dr-a Firmware Sysmac Cp2e-e40dr-a Sysmac Cp2e-e40dr-a Firmware Sysmac Cp2e-e60dr-a Sysmac Cp2e-e60dr-a Firmware Sysmac Cp2e-n14dr-a Sysmac Cp2e-n14dr-a Firmware Sysmac Cp2e-n14dr-d Sysmac Cp2e-n14dr-d Firmware Sysmac Cp2e-n14dt-a Sysmac Cp2e-n14dt-a Firmware Sysmac Cp2e-n14dt-d Sysmac Cp2e-n14dt-d Firmware Sysmac Cp2e-n14dt1-d Sysmac Cp2e-n14dt1-d Firmware Sysmac Cp2e-n20dr-a Sysmac Cp2e-n20dr-a Firmware Sysmac Cp2e-n20dr-d Sysmac Cp2e-n20dr-d Firmware Sysmac Cp2e-n20dt-a Sysmac Cp2e-n20dt-a Firmware Sysmac Cp2e-n20dt-d Sysmac Cp2e-n20dt-d Firmware Sysmac Cp2e-n20dt1-d Sysmac Cp2e-n20dt1-d Firmware Sysmac Cp2e-n30dr-a Sysmac Cp2e-n30dr-a Firmware Sysmac Cp2e-n30dr-d Sysmac Cp2e-n30dr-d Firmware Sysmac Cp2e-n30dt-a Sysmac Cp2e-n30dt-a Firmware Sysmac Cp2e-n30dt-d Sysmac Cp2e-n30dt-d Firmware Sysmac Cp2e-n30dt1-d Sysmac Cp2e-n30dt1-d Firmware Sysmac Cp2e-n40dr-a Sysmac Cp2e-n40dr-a Firmware Sysmac Cp2e-n40dr-d Sysmac Cp2e-n40dr-d Firmware Sysmac Cp2e-n40dt-a Sysmac Cp2e-n40dt-a Firmware Sysmac Cp2e-n40dt-d Sysmac Cp2e-n40dt-d Firmware Sysmac Cp2e-n40dt1-d Sysmac Cp2e-n40dt1-d Firmware Sysmac Cp2e-n60dr-a Sysmac Cp2e-n60dr-a Firmware Sysmac Cp2e-n60dr-d Sysmac Cp2e-n60dr-d Firmware Sysmac Cp2e-n60dt-a Sysmac Cp2e-n60dt-a Firmware Sysmac Cp2e-n60dt-d Sysmac Cp2e-n60dt-d Firmware Sysmac Cp2e-n60dt1-d Sysmac Cp2e-n60dt1-d Firmware Sysmac Cp2e-s30dr-a Sysmac Cp2e-s30dr-a Firmware Sysmac Cp2e-s30dt-d Sysmac Cp2e-s30dt-d Firmware Sysmac Cp2e-s30dt1-d Sysmac Cp2e-s30dt1-d Firmware Sysmac Cp2e-s40dr-a Sysmac Cp2e-s40dr-a Firmware Sysmac Cp2e-s40dt-d Sysmac Cp2e-s40dt-d Firmware Sysmac Cp2e-s40dt1-d Sysmac Cp2e-s40dt1-d Firmware Sysmac Cp2e-s60dr-a Sysmac Cp2e-s60dr-a Firmware Sysmac Cp2e-s60dt-d Sysmac Cp2e-s60dt-d Firmware Sysmac Cp2e-s60dt1-d Sysmac Cp2e-s60dt1-d Firmware Sysmac Cs1w-drm21-v1 Sysmac Cs1w-drm21-v1 Firmware Sysmac Cs1w-eip21 Sysmac Cs1w-eip21 Firmware Sysmac Cs1w-etn21 Sysmac Cs1w-etn21 Firmware Sysmac Cs1w-fln22 Sysmac Cs1w-fln22 Firmware Sysmac Cs1w-nc\[\]71 Sysmac Cs1w-nc\[\]71 Firmware Sysmac Cs1w-spu01-v2 Sysmac Cs1w-spu01-v2 Firmware Sysmac Cs1w-spu02-v2 Sysmac Cs1w-spu02-v2 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-01-16T21:42:32.824Z

Reserved: 2023-02-13T15:41:55.590Z

Link: CVE-2023-0811

cve-icon Vulnrichment

Updated: 2024-08-02T05:24:34.505Z

cve-icon NVD

Status : Modified

Published: 2023-03-16T18:15:11.160

Modified: 2024-11-21T07:37:52.850

Link: CVE-2023-0811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses