CVE-2023-22357

Published: Jan 17, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote unauthenticated attacker may read/write in arbitrary area of the device memory, which may lead to overwriting the firmware, causing a denial-of-service (DoS) condition, and/or arbitrary code execution.

Affected (1)

Products: Omron: Cp1l El20dr D Firmware

1 product

Cp1l El20dr D Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Omron Cp1l El20dr D Firmware	All versions

Running on/with	Platform Versions
Omron Cp1l El20dr D	All versions

Related CWEs

Active Debug Code

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

References (2)

https://jvn.jp/en/vu/JVNVU97575890/index.html

Source: vultures@jpcert.or.jp

Third Party Advisory

https://jvn.jp/en/vu/JVNVU97575890/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.