CVE-2022-31207

published 2022-07-26

CVE-2022-31207: The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS…

Priority P2 60 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to the PLC. This protocol has authentication flaws as reported in FSCT-2022-0057. Control logic is downloaded to PLC volatile memory using the FINS Program Area Read and Program Area Write commands or to non-volatile memory using other commands from where it can be loaded into volatile memory for execution. The logic that is loaded into and executed from the user program area exists in compiled object code form. Upon execution, these object codes are first passed to a dedicated ASIC that determines whether the object code is to be executed by the ASIC or the microprocessor. In the former case, the object code is interpreted by the ASIC whereas in the latter case the object code is passed to the microprocessor for object code interpretation by a ROM interpreter. In the abnormal case where the object code cannot be handled by either, an abnormal condition is triggered and the PLC is halted. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, thus allowing an attacker to manipulate transmitted object code to the PLC and either execute arbitrary object code commands on the ASIC or on the microprocessor interpreter.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
omron	sysmac_cj2h_firmware	< 1.5	1.5
omron	sysmac_cj2m_firmware	< 2.1	2.1
omron	sysmac_cp1e_firmware	< 1.30	1.30
omron	sysmac_cp1h_firmware	< 1.30	1.30
omron	sysmac_cp1l_firmware	< 1.10	1.10
omron	sysmac_cs1_firmware	< 4.1	4.1

Detection & IOCs extracted from sources · hover to see the quote

port 9600/TCP↗

• → Monitor for unauthenticated Omron FINS protocol traffic on TCP/9600, specifically FINS Program Area Read and Program Area Write commands, which can be used to download or manipulate PLC control logic without cryptographic authentication. ↗
• → Alert on FINS protocol sessions originating from unexpected or external hosts targeting Omron SYSMAC CS/CJ/CP series PLCs, as the vulnerability allows arbitrary object code execution without authentication. ↗
• → Detect abnormal PLC halt conditions on Omron SYSMAC CS/CJ/CP devices, which may indicate attempted injection of malformed or malicious object code that cannot be handled by the ASIC or microprocessor interpreter. ↗

• · All versions of SYSMAC CS/CJ/CP series are affected by CVE-2022-31207; there is no firmware patch — Omron's mitigation relies on enabling the PLC protection password and hardware DIP switches to prevent unauthorized writes. ↗
• · No known public exploits specifically target this vulnerability at time of advisory publication. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-347