CVE-2022-31204

Published: Jul 26, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.

Affected (8)

Products: Omron: Sysmac Cs1 Firmware, Sysmac Cj2m Firmware, Sysmac Cj2h Firmware, Sysmac Cp1e Firmware, Sysmac Cp1h Firmware, Sysmac Cp1l Firmware, Cp1w Cif41 Firmware, Cx Programmer

8 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cs1 Firmware	Before 4.1

Running on/with	Platform Versions
Omron Sysmac Cs1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cj2m Firmware	Before 2.1

Running on/with	Platform Versions
Omron Sysmac Cj2m	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cj2h Firmware	Before 1.5

Running on/with	Platform Versions
Omron Sysmac Cj2h	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cp1e Firmware	Before 1.30

Running on/with	Platform Versions
Omron Sysmac Cp1e	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cp1h Firmware	Before 1.30

Running on/with	Platform Versions
Omron Sysmac Cp1h	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cp1l Firmware	Before 1.10

Running on/with	Platform Versions
Omron Sysmac Cp1l	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Cp1w Cif41 Firmware	All versions

Running on/with	Platform Versions
Omron Cp1w Cif41	All versions

Configuration H

1 vulnerable

Vulnerable Software	Affected Versions
Omron Cx Programmer	Before 9.6

Related CWEs

CWE-319

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (4)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Source: cve@mitre.org

Third Party Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.