Sign-up

ID

VAR-202203-1537


CVE

CVE-2022-26417


TITLE

Omron CX-Position  Vulnerabilities in the use of freed memory

Trust: 0.8

sources: JVNDB: JVNDB-2022-001554

DESCRIPTION

Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may allow an attacker to execute arbitrary code. Omron CX-Position Is vulnerable to the use of freed memory.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Omron CX-One. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the parsing of NCI files in the CX-Position module. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Omron CX-Position is a position control software of Japan Omron Company. Simplifies all aspects of position control, from creating/editing data used in position control units (NC units) to online communication and monitoring operations

Trust: 2.34

sources: NVD: CVE-2022-26417 // JVNDB: JVNDB-2022-001554 // ZDI: ZDI-22-578 // VULHUB: VHN-418115

AFFECTED PRODUCTS

vendor:omronmodel:cx-positionscope:lteversion:2.5.3

Trust: 1.0

vendor:オムロン株式会社model:cx-positionscope:eqversion: -

Trust: 0.8

vendor:オムロン株式会社model:cx-positionscope:lteversion:2.5.3 and earlier

Trust: 0.8

vendor:omronmodel:cx-onescope: - version: -

Trust: 0.7

sources: ZDI: ZDI-22-578 // JVNDB: JVNDB-2022-001554 // NVD: CVE-2022-26417

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-26417
value: HIGH

Trust: 1.0

ics-cert@hq.dhs.gov: CVE-2022-26417
value: HIGH

Trust: 1.0

NVD: CVE-2022-26417
value: HIGH

Trust: 0.8

ZDI: CVE-2022-26417
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202203-2481
value: HIGH

Trust: 0.6

VULHUB: VHN-418115
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-26417
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-418115
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-26417
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 2.0

OTHER: JVNDB-2022-001554
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

ZDI: CVE-2022-26417
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-22-578 // VULHUB: VHN-418115 // JVNDB: JVNDB-2022-001554 // CNNVD: CNNVD-202203-2481 // NVD: CVE-2022-26417 // NVD: CVE-2022-26417

PROBLEMTYPE DATA

problemtype:CWE-416

Trust: 1.1

problemtype:Use of freed memory (CWE-416) [ Other ]

Trust: 0.8

sources: VULHUB: VHN-418115 // JVNDB: JVNDB-2022-001554 // NVD: CVE-2022-26417

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202203-2481

TYPE

resource management error

Trust: 0.6

sources: CNNVD: CNNVD-202203-2481

PATCH

title:top pageurl:https://www.fa.omron.co.jp/

Trust: 0.8

title:Omron has issued an update to correct this vulnerability.url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02

Trust: 0.7

sources: ZDI: ZDI-22-578 // JVNDB: JVNDB-2022-001554

EXTERNAL IDS

db:NVDid:CVE-2022-26417

Trust: 4.0

db:ICS CERTid:ICSA-22-088-02

Trust: 2.5

db:ZDIid:ZDI-22-578

Trust: 2.4

db:JVNid:JVNVU96756124

Trust: 0.8

db:JVNDBid:JVNDB-2022-001554

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-14753

Trust: 0.7

db:CNNVDid:CNNVD-202203-2481

Trust: 0.7

db:AUSCERTid:ESB-2022.1347

Trust: 0.6

db:CS-HELPid:SB2022033010

Trust: 0.6

db:VULHUBid:VHN-418115

Trust: 0.1

sources: ZDI: ZDI-22-578 // VULHUB: VHN-418115 // JVNDB: JVNDB-2022-001554 // CNNVD: CNNVD-202203-2481 // NVD: CVE-2022-26417

REFERENCES

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-02

Trust: 3.2

url:https://www.zerodayinitiative.com/advisories/zdi-22-578/

Trust: 2.3

url:http://jvn.jp/vu/jvnvu96756124/index.html

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-26417

Trust: 0.8

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-088-02

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022033010

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-26417/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1347

Trust: 0.6

sources: ZDI: ZDI-22-578 // VULHUB: VHN-418115 // JVNDB: JVNDB-2022-001554 // CNNVD: CNNVD-202203-2481 // NVD: CVE-2022-26417

CREDITS

xina1i

Trust: 0.7

sources: ZDI: ZDI-22-578

SOURCES

db:ZDIid:ZDI-22-578
db:VULHUBid:VHN-418115
db:JVNDBid:JVNDB-2022-001554
db:CNNVDid:CNNVD-202203-2481
db:NVDid:CVE-2022-26417

LAST UPDATE DATE

2024-11-23T22:36:51.847000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-22-578date:2022-04-05T00:00:00
db:VULHUBid:VHN-418115date:2022-04-08T00:00:00
db:JVNDBid:JVNDB-2022-001554date:2022-04-19T05:47:00
db:CNNVDid:CNNVD-202203-2481date:2022-04-11T00:00:00
db:NVDid:CVE-2022-26417date:2024-11-21T06:53:54.740

SOURCES RELEASE DATE

db:ZDIid:ZDI-22-578date:2022-04-05T00:00:00
db:VULHUBid:VHN-418115date:2022-04-01T00:00:00
db:JVNDBid:JVNDB-2022-001554date:2022-04-19T00:00:00
db:CNNVDid:CNNVD-202203-2481date:2022-03-29T00:00:00
db:NVDid:CVE-2022-26417date:2022-04-01T23:15:14.590