github - ghsa-5xrh-m4jr-pgwp

ghsa-5xrh-m4jr-pgwp

Vulnerability from github

Published

2022-05-24 17:03

Modified

2023-04-28 00:30

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, the software properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-18269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-412"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-16T20:15:00Z",
    "severity": "HIGH"
  },
  "details": "In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, the software properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.",
  "id": "GHSA-5xrh-m4jr-pgwp",
  "modified": "2023-04-28T00:30:28Z",
  "published": "2022-05-24T17:03:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18269"
    },
    {
      "type": "WEB",
      "url": "https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.us-cert.gov/ics/advisories/icsa-19-346-02"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2019-18269 (GCVE-0-2019-18269)

Vulnerability from cvelistv5

Published

2019-12-16 19:21

Modified

2024-08-05 01:47

Severity ?

CWE

CWE-412 - Unrestricted Externally Accessible Lock

Summary

Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.

References

►

URL

Tags

	https://www.us-cert.gov/ics/advisories/icsa-19-346-02	x_refsource_MISC
	https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf

Impacted products

Vendor

Product

Version

►

Omron PLC CJ Series

Version: all versions

	Omron	Omron PLC CS series	Version: all versions
	Omron	Omron PLC NX1P2 series	Version: all versions

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T01:47:14.075Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.us-cert.gov/ics/advisories/icsa-19-346-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Omron PLC CJ Series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Omron PLC CS series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Omron PLC NX1P2 series",
          "vendor": "Omron",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Jipeng You (XDU) and n0b0dy reported these vulnerabilities to CISA."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eOmron\u2019s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. \u003c/span\u003e\n\n"
            }
          ],
          "value": "\nOmron\u2019s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. \n\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-412",
              "description": "CWE-412 Unrestricted Externally Accessible Lock",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-27T22:40:45.810Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.us-cert.gov/ics/advisories/icsa-19-346-02"
        },
        {
          "url": "https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cp\u003eOmron recommends the following mitigation measures:\u003c/p\u003e\u003cul\u003e\u003cli\u003eFilter FINS port: Protect access to Omron\u2019s PLC with a firewall and blocking unnecessary remote access to FINS port (default: 9600).\u003c/li\u003e\u003cli\u003eFilter IP addresses: Protect access to Omron\u2019s PLC with a firewall and filtering devices connected to the PLC by IP address.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor more information provided by Omron on these vulnerabilities refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://gcc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.omron-cxone.com%2Fsecurity%2F2019-12-06_PLC_EN.pdf\u0026amp;data=02%7C01%7Ckent.norris%40inl.gov%7C20bf150382654ea6bed508d77a33e9d1%7C4cf464b7869a42368da2a98566485554%7C0%7C1%7C637112235716101466\u0026amp;sdata=HF291pOMe65LwSvq4DynQqT%2FX7Sw%2BT92JGwRsXmC7WU%3D\u0026amp;reserved=0\"\u003eVulnerabilities in Omron CS and CJ series CPU PLCs\u003c/a\u003e.\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "\nOmron recommends the following mitigation measures:\n\n  *  Filter FINS port: Protect access to Omron\u2019s PLC with a firewall and blocking unnecessary remote access to FINS port (default: 9600).\n  *  Filter IP addresses: Protect access to Omron\u2019s PLC with a firewall and filtering devices connected to the PLC by IP address.\n\n\nFor more information provided by Omron on these vulnerabilities refer to  Vulnerabilities in Omron CS and CJ series CPU PLCs https://gcc01.safelinks.protection.outlook.com/ .\n\n\n\n\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2019-18269",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Omron PLC CJ and CS Series",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Omron PLC CJ series, all versions, Omron PLC CS series, all versions"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, the software properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "UNRESTRICTED EXTERNALLY ACCESSIBLE LOCK CWE-412"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.us-cert.gov/ics/advisories/icsa-19-346-02",
              "refsource": "MISC",
              "url": "https://www.us-cert.gov/ics/advisories/icsa-19-346-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2019-18269",
    "datePublished": "2019-12-16T19:21:31",
    "dateReserved": "2019-10-22T00:00:00",
    "dateUpdated": "2024-08-05T01:47:14.075Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.