Critical severity · published Dec 16, 2019
CVE-2019-18259
In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Plc CJ Firmware · Omron
All versions, or not specified · source: NVD
PC
Plc CS Firmware · Omron
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18259
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-346-02
More from Plc CJ Firmware
9.8
CVE-2019-18269
Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability
9.8
CVE-2019-18261
In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent…
8.1
CVE-2019-13533
In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the controller and replay requests that could…