CVE-2024-31413 - OpenCVE

Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower, and was updated through CX-One V4 auto update in January 2024 or prior) and Sysmac Studio SYSMAC-SE2[][][] (The version which was installed with a DVD ver. 1.56 or lower, and was updated through Sysmac Studio V1 auto update in January 2024 or prior). Opening a specially crafted project file may lead to arbitrary code execution.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Omrom	Cx-designer

No data.

No data.

References

Link	Providers
https://jvn.jp/en/vu/JVNVU98274902/
https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-002_en.pdf

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2024-05-01T12:54:15.483Z

Updated: 2024-08-02T01:52:56.897Z

Reserved: 2024-04-03T10:57:10.684Z

Link: CVE-2024-31413

Vulnrichment

Updated: 2024-05-01T14:59:52.823Z

NVD

Status : Awaiting Analysis

Published: 2024-05-01T13:15:52.080

Modified: 2024-07-03T01:54:50.813

Link: CVE-2024-31413

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31413", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-04-03T10:57:10.684Z", "datePublished": "2024-05-01T12:54:15.483Z", "dateUpdated": "2024-08-02T01:52:56.897Z"}, "containers": {"cna": {"affected": [{"vendor": "OMRON Corporation", "product": "CX-One CX-One CXONE-AL[][]D-V4 ", "versions": [{"version": "The version which was installed with a DVD ver. 4.61.1 or lower", "status": "affected"}, {"version": " and was updated through CX-One V4 auto update in January 2024 or prior", "status": "affected"}]}, {"vendor": "OMRON Corporation", "product": "Sysmac Studio SYSMAC-SE2[][][] ", "versions": [{"version": "The version which was installed with a DVD ver. 1.56 or lower", "status": "affected"}, {"version": " and was updated through Sysmac Studio V1 auto update in January 2024 or prior", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower, and was updated through CX-One V4 auto update in January 2024 or prior) and Sysmac Studio SYSMAC-SE2[][][] (The version which was installed with a DVD ver. 1.56 or lower, and was updated through Sysmac Studio V1 auto update in January 2024 or prior). Opening a specially crafted project file may lead to arbitrary code execution."}], "problemTypes": [{"descriptions": [{"description": "Free of pointer not at start of buffer", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-002_en.pdf"}, {"url": "https://jvn.jp/en/vu/JVNVU98274902/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-05-01T12:54:15.483Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-31413", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T14:49:56.532150Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:omrom:cx-designer:*:*:*:*:*:*:*:*"], "vendor": "omrom", "product": "cx-designer", "versions": [{"status": "affected", "version": "*"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:36:59.028Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:52:56.897Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-002_en.pdf", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/vu/JVNVU98274902/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31413", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2024-04-03T10:57:10.684Z", "datePublished": "2024-05-01T12:54:15.483Z", "dateUpdated": "2024-06-04T17:36:59.028Z"}, "containers": {"cna": {"affected": [{"vendor": "OMRON Corporation", "product": "CX-One CX-One CXONE-AL[][]D-V4 ", "versions": [{"version": "The version which was installed with a DVD ver. 4.61.1 or lower", "status": "affected"}, {"version": " and was updated through CX-One V4 auto update in January 2024 or prior", "status": "affected"}]}, {"vendor": "OMRON Corporation", "product": "Sysmac Studio SYSMAC-SE2[][][] ", "versions": [{"version": "The version which was installed with a DVD ver. 1.56 or lower", "status": "affected"}, {"version": " and was updated through Sysmac Studio V1 auto update in January 2024 or prior", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower, and was updated through CX-One V4 auto update in January 2024 or prior) and Sysmac Studio SYSMAC-SE2[][][] (The version which was installed with a DVD ver. 1.56 or lower, and was updated through Sysmac Studio V1 auto update in January 2024 or prior). Opening a specially crafted project file may lead to arbitrary code execution."}], "problemTypes": [{"descriptions": [{"description": "Free of pointer not at start of buffer", "lang": "en", "type": "text"}]}], "references": [{"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-002_en.pdf"}, {"url": "https://jvn.jp/en/vu/JVNVU98274902/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2024-05-01T12:54:15.483Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-31413", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T14:49:56.532150Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:omrom:cx-designer:*:*:*:*:*:*:*:*"], "vendor": "omrom", "product": "cx-designer", "versions": [{"status": "affected", "version": "*"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-01T14:59:52.823Z"}, "title": "CISA ADP Vulnrichment"}]}}