CVE-2022-31205 Information disclosure in n/a
Attackers can read the Web UI password from memory via the FINS protocol without authentication, compromising access to Omron PLCs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31205?
CVE-2022-31205 is a high-severity vulnerability in n/a, published on 26 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication.
Weakness: CWE-312
Which versions are affected by CVE-2022-31205?
It affects 7 products.
Products include Omron Cp1w-Cif41 Firmware, Omron Sysmac Cj2h Firmware, Omron Sysmac Cj2m Firmware, Omron Sysmac Cp1e Firmware, Omron Sysmac Cp1h Firmware, Omron Sysmac Cp1l Firmware and 1 more.
How do I fix CVE-2022-31205?
No fix has been published for CVE-2022-31205 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-31205 being exploited?
There is no known exploitation of CVE-2022-31205 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c5rh-wr27-mrw6.