High severity · published Jul 4, 2022
CVE-2022-33971
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all…
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Nj-pa3001 Firmware · Omron
through 1.48 · source: NVD
NF
Nj-pd3001 Firmware · Omron
through 1.48 · source: NVD
NF
Nj101-1000 Firmware · Omron
through 1.48 · source: NVD
NF
Nj101-1020 Firmware · Omron
through 1.48 · source: NVD
NF
Nj101-9000 Firmware · Omron
through 1.48 · source: NVD
NF
Nj101-9020 Firmware · Omron
through 1.48 · source: NVD
NF
Nj301-1100 Firmware · Omron
through 1.48 · source: NVD
NF
Nj301-1200 Firmware · Omron
before 1.48 · source: NVD
NF
Nj501-1300 Firmware · Omron
through 1.48 · source: NVD
NF
Nj501-1320 Firmware · Omron
through 1.48 · source: NVD
NF
Nj501-1340 Firmware · Omron
through 1.48 · source: NVD
NF
Nj501-140 Firmware · Omron
through 1.48 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-33971
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-33971
Third Party Advisory
https://jvn.jp/en/vu/JVNVU97050784/index.html
Mitigation
https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf
More from Nj-pa3001 Firmware
8.1
CVE-2022-34151
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models…
8.1
CVE-2022-33208
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all…
7.5
CVE-2024-33687
Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions