high7.5
CVE-2022-31204
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords.
Impact
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Omron | Sysmac Cs1 Firmware | before 4.1 |
| Omron | Sysmac Cj2m Firmware | before 2.1 |
| Omron | Sysmac Cj2h Firmware | before 1.5 |
| Omron | Sysmac Cp1e Firmware | before 1.30 |
| Omron | Sysmac Cp1h Firmware | before 1.30 |
| Omron | Sysmac Cp1l Firmware | before 1.10 |
| Omron | Cp1w-Cif41 Firmware | All versions |
| Omron | Cx-Programmer | before 9.6 |