Critical severity · published Oct 6, 2015
CVE-2015-0987
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to…
10.0
CVSS
1.2%
EPSS
No
On KEV
Description
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cj2h Plc · Omron
through 1.4 · source: NVD
CP
Cj2m Plc · Omron
through 2.0 · source: NVD
CX
Cx-programmer · Omron
through 9.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0987
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0987
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-15-274-01
More from Cj2h Plc
–
CVE-2015-1015
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 use a reversible format for password storage in object files on Compact Flash…