CVE-2022-31205

Published: Jul 26, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication.

Affected (7)

Products: Omron: Sysmac Cs1 Firmware, Sysmac Cj2m Firmware, Sysmac Cj2h Firmware, Sysmac Cp1e Firmware, Sysmac Cp1h Firmware, Sysmac Cp1l Firmware, Cp1w Cif41 Firmware

7 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cs1 Firmware	Before 4.1

Running on/with	Platform Versions
Omron Sysmac Cs1	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cj2m Firmware	Before 2.1

Running on/with	Platform Versions
Omron Sysmac Cj2m	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cj2h Firmware	Before 1.5

Running on/with	Platform Versions
Omron Sysmac Cj2h	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cp1e Firmware	Before 1.30

Running on/with	Platform Versions
Omron Sysmac Cp1e	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cp1h Firmware	Before 1.30

Running on/with	Platform Versions
Omron Sysmac Cp1h	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Sysmac Cp1l Firmware	Before 1.10

Running on/with	Platform Versions
Omron Sysmac Cp1l	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Cp1w Cif41 Firmware	All versions

Running on/with	Platform Versions
Omron Cp1w Cif41	All versions

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (4)

https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Source: cve@mitre.org

Third Party Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.forescout.com/blog/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.