omron sysmac_cs1_firmware 密码学签名的验证不恰当
CVE编号
CVE-2022-31207利用情况
暂无补丁情况
N/A披露时间
2022-07-27漏洞描述
The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to the PLC. This protocol has authentication flaws as reported in FSCT-2022-0057. Control logic is downloaded to PLC volatile memory using the FINS Program Area Read and Program Area Write commands or to non-volatile memory using other commands from where it can be loaded into volatile memory for execution. The logic that is loaded into and executed from the user program area exists in compiled object code form. Upon execution, these object codes are first passed to a dedicated ASIC that determines whether the object code is to be executed by the ASIC or the microprocessor. In the former case, the object code is interpreted by the ASIC whereas in the latter case the object code is passed to the microprocessor for object code interpretation by a ROM interpreter. In the abnormal case where the object code cannot be handled by either, an abnormal condition is triggered and the PLC is halted. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, thus allowing an attacker to manipulate transmitted object code to the PLC and either execute arbitrary object code commands on the ASIC or on the microprocessor interpreter.解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02 | |
| https://www.forescout.com/blog/ |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 系统 | omron | cp1w-cif41_firmware | - | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | omron | sysmac_cj2h_firmware | * | Up to (excluding) 1.5 | |||||
| 运行在以下环境 | |||||||||
| 系统 | omron | sysmac_cj2m_firmware | * | Up to (excluding) 2.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | omron | sysmac_cp1e_firmware | * | Up to (excluding) 1.30 | |||||
| 运行在以下环境 | |||||||||
| 系统 | omron | sysmac_cp1h_firmware | * | Up to (excluding) 1.30 | |||||
| 运行在以下环境 | |||||||||
| 系统 | omron | sysmac_cp1l_firmware | * | Up to (excluding) 1.10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | omron | sysmac_cs1_firmware | * | Up to (excluding) 4.1 | |||||
| 运行在以下环境 | |||||||||
| 硬件 | omron | cp1w-cif41 | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | omron | sysmac_cj2h | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | omron | sysmac_cj2m | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | omron | sysmac_cp1e | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | omron | sysmac_cp1h | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | omron | sysmac_cp1l | - | - | |||||
| 运行在以下环境 | |||||||||
| 硬件 | omron | sysmac_cs1 | - | - | |||||
- 攻击路径 网络
- 攻击复杂度 低
- 权限要求 无
- 影响范围 未更改
- 用户交互 无
- 可用性 高
- 保密性 高
- 完整性 高
| CWE-ID | 漏洞类型 |
| CWE-347 | 密码学签名的验证不恰当 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论