CVEvulnerability

CVE-2022-31204

7.5 HIGH Published 2022-07-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-07-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-319

Description

Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.

Affected configurations

• omron sysmac cs1 firmware (< 4.1) • omron sysmac cj2m firmware (< 2.1) • omron sysmac cj2h firmware (< 1.5) • omron sysmac cp1e firmware (< 1.30) • omron sysmac cp1h firmware (< 1.30) • omron sysmac cp1l firmware (< 1.10) • omron cp1w-cif41 firmware • omron cx-programmer (< 9.6)

Related

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

Referenced by CWE · observed example (2)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References