CVE-2022-31206

published 2022-07-26

CVE-2022-31206: The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs…

Priority P3 58 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
omron	nj101-1000_firmware	< 1.49	1.49
omron	nj101-1020_firmware	< 1.49	1.49
omron	nj101-9000_firmware	< 1.49	1.49
omron	nj101-9020_firmware	< 1.49	1.49
omron	nj301-1100_firmware	< 1.49	1.49
omron	nj301-1200_firmware	< 1.49	1.49
omron	nj501-1300_firmware	< 1.49	1.49
omron	nj501-1320_firmware	< 1.49	1.49
omron	nj501-1340_firmware	< 1.49	1.49
omron	nj501-1400_firmware	< 1.49	1.49
omron	nj501-1420_firmware	< 1.49	1.49
omron	nj501-1500_firmware	< 1.49	1.49
omron	nj501-1520_firmware	< 1.49	1.49
omron	nj501-4300_firmware	< 1.49	1.49
omron	nj501-4320_firmware	< 1.49	1.49
omron	nj501-4400_firmware	< 1.49	1.49
omron	nj501-4500_firmware	< 1.49	1.49
omron	nj501-5300-1_firmware	< 1.49	1.49
omron	nj501-5300_firmware	< 1.49	1.49
omron	nx701-1600_firmware	< 1.29	1.29
omron	nx701-1620_firmware	< 1.29	1.29
omron	nx701-1700_firmware	< 1.29	1.29
omron	nx701-1720_firmware	< 1.29	1.29
omron	nx701-z600_firmware	< 1.29	1.29
omron	nx701-z700_firmware	< 1.29	1.29

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-347