CVE-2023-0811: Omron CJ1M SYSMAC CJ-series, заобикаляне на вход и

Описание

Оригинално описание

Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.

Засегнати продукти

• Omron CJ1M SYSMAC CJ-series: All versions
• Omron CJ1M SYSMAC CJ-series: All versions
• Omron CJ1M SYSMAC CJ-series: All versions
• Omron CJ1M SYSMAC CJ-series: All versions
• Omron CJ1M SYSMAC CS-series : All versions
• Omron CJ1M SYSMAC CS-series : All versions
• Omron CJ1M SYSMAC CS-series : All versions
• Omron CJ1M SYSMAC CS-series : All versions
• Omron CJ1M SYSMAC CS-series : All versions
• Omron CJ1M SYSMAC CS-series : All versions
• Omron CJ1M SYSMAC CS-series : All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions
• Omron CJ1M SYSMAC CP-series: All versions

Вид слабост

• CWE-284 Неправилен контрол на достъпа

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-0811
• https://nvd.nist.gov/vuln/detail/CVE-2023-0811
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-073-01
• https://www.ia.omron.com/product/vulnerability/OMSR-2023-001_en.pdf