High severity · published Dec 16, 2019
CVE-2019-13533
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could…
8.1
CVSS
0.9%
EPSS
No
On KEV
Description
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could result in the opening and closing of industrial valves.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Plc CJ Firmware · Omron
All versions, or not specified · source: NVD
PC
Plc CS Firmware · Omron
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-13533
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-13533
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-346-02
More from Plc CJ Firmware
9.8
CVE-2019-18269
Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability
9.8
CVE-2019-18261
In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent…
9.8
CVE-2019-18259
In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands