CVE-2022-31207
Estado: ModificadaCrítica (9.8)—
The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to the PLC. This protocol has authentication flaws as reported in FSCT-2022-0057. Control logic is downloaded to PLC volatile memory using the FINS Program Area Read and Program Area Write commands or to non-volatile memory using other commands from where it can be loaded into volatile memory for execution.
Leer descripción completaMostrar menos
The logic that is loaded into and executed from the user program area exists in compiled object code form. Upon execution, these object codes are first passed to a dedicated ASIC that determines whether the object code is to be executed by the ASIC or the microprocessor. In the former case, the object code is interpreted by the ASIC whereas in the latter case the object code is passed to the microprocessor for object code interpretation by a ROM interpreter. In the abnormal case where the object code cannot be handled by either, an abnormal condition is triggered and the PLC is halted. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, thus allowing an attacker to manipulate transmitted object code to the PLC and either execute arbitrary object code commands on the ASIC or on the microprocessor interpreter.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.97%
- Percentil entre todas las CVEs puntuadas: 61
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (7)
CWE
- CWE-347
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2022-31207",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2022-07-26T22:15:11.440",
"references": [
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.forescout.com/blog/",
"tags": [
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.forescout.com/blog/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to the PLC. This protocol has authentication flaws as reported in FSCT-2022-0057. Control logic is downloaded to PLC volatile memory using the FINS Program Area Read and Program Area Write commands or to non-volatile memory using other commands from where it can be loaded into volatile memory for execution. The logic that is loaded into and executed from the user program area exists in compiled object code form. Upon execution, these object codes are first passed to a dedicated ASIC that determines whether the object code is to be executed by the ASIC or the microprocessor. In the former case, the object code is interpreted by the ASIC whereas in the latter case the object code is passed to the microprocessor for object code interpretation by a ROM interpreter. In the abnormal case where the object code cannot be handled by either, an abnormal condition is triggered and the PLC is halted. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, thus allowing an attacker to manipulate transmitted object code to the PLC and either execute arbitrary object code commands on the ASIC or on the microprocessor interpreter."
},
{
"lang": "es",
"value": "Los PLC de la familia de productos SYSMAC Cx de Omron (series CS, CJ y CP) versiones hasta 18-05-2022, carecen de autenticación criptográfica. Usan el protocolo FINS (9600/TCP) de Omron para fines de ingeniería, incluida la descarga de proyectos y lógica de control al PLC. Este protocolo presenta fallos de autenticación, como es indicado en el documento FSCT-2022-0057. La lógica de control es descargada en la memoria volátil del PLC Usando los comandos FINS Program Area Read y Program Area Write o en la memoria no volátil Usando otros comandos desde donde puede ser cargado en la memoria volátil para su ejecución. La lógica que es cargada y ejecutada desde el área de programa de usuario se presenta en forma de código objeto compilado. Al ejecutarse, estos códigos objeto son pasados primero a un ASIC dedicado que determina si el código objeto debe ser ejecutado por el ASIC o por el microprocesador. En el primer caso, el código objeto es interpretado por el ASIC, mientras que en el segundo caso el código objeto es pasado al microprocesador para que sea interpretado por un intérprete ROM. En el caso anormal en el que el código objeto no puede ser manejado por ninguno de los dos, es desencadenada una condición anormal y el PLC es detenido. La lógica que es descargada en el PLC no parece estar autenticada criptográficamente, lo que permite a un atacante manipular el código objeto transmitido al PLC y ejecutar comandos de código objeto arbitrarios en el ASIC o en el intérprete del microprocesador.\n"
}
],
"lastModified": "2026-06-17T04:45:07.340",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:omron:sysmac_cs1_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC0EDECA-0697-4BF1-AC39-7DAEAFA79FE5",
"versionEndExcluding": "4.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:omron:sysmac_cs1:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6F4E42A1-A6A5-4590-A369-C3E11C55979B"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:omron:sysmac_cj2m_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FC2E363E-0118-4CA4-BD97-6C4FE939BA3E",
"versionEndExcluding": "2.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:omron:sysmac_cj2m:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4EC6E3CB-486B-4C41-87D7-BF16D9B9FA74"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:omron:sysmac_cj2h_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "464F762D-50B7-4BC7-87B8-C6E0CDBB05DA",
"versionEndExcluding": "1.5"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:omron:sysmac_cj2h:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "179BC3C6-8530-4680-8DAA-B8734C3F088A"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:omron:sysmac_cp1e_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6C2FE1EA-5A52-4245-8F66-60A88F3C5E5C",
"versionEndExcluding": "1.30"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:omron:sysmac_cp1e:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4A3E5CC5-3B48-4CD0-8CE0-F12AA0A8A1CA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:omron:sysmac_cp1h_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9846BE46-9506-4434-BAA6-13A8AF687EC5",
"versionEndExcluding": "1.30"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:omron:sysmac_cp1h:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1334C61E-D200-427B-833E-5FB538930F80"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:omron:sysmac_cp1l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3AAB91A7-28FD-4462-AD62-40A010D3FD33",
"versionEndExcluding": "1.10"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:omron:sysmac_cp1l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E74FC37C-0054-49E8-92CB-7BCF903D12C6"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:omron:cp1w-cif41_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99A34BA8-7D88-4D08-A8F0-99570A397299"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:omron:cp1w-cif41:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "83911864-386F-40A2-BB2D-7E3443E3EDB8"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}