CVE-2022-31204 Information disclosure in n/a
Omron PLCs transmit UM Protection passwords in cleartext, allowing attackers to intercept credentials and bypass restrictions on sensitive engineering operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31204?
CVE-2022-31204 is a high-severity vulnerability in n/a, published on 26 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.
Weakness: CWE-319
Which versions are affected by CVE-2022-31204?
It affects 8 products.
Products include Omron Cp1w-Cif41 Firmware, Omron Cx-Programmer, Omron Sysmac Cj2h Firmware, Omron Sysmac Cj2m Firmware, Omron Sysmac Cp1e Firmware, Omron Sysmac Cp1h Firmware and 2 more.
How do I fix CVE-2022-31204?
No fix has been published for CVE-2022-31204 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-31204 being exploited?
There is no known exploitation of CVE-2022-31204 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-r7cc-f77m-gvjj.