Details of VAR-202401-1097

ID

VAR-202401-1097

CVE

CVE-2022-45790

TITLE

Vulnerability related to improper restriction of excessive authentication attempts in multiple OMRON Corporation products

Trust: 0.8

sources: JVNDB: JVNDB-2022-025065

DESCRIPTION

The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic. cj1g-cpu45p firmware, cj1g-cpu45p-gtc firmware, cj1g-cpu44p Multiple OMRON Corporation products, including firmware, contain a vulnerability related to improper restriction of excessive authentication attempts.Information may be obtained and information may be tampered with

Trust: 1.62

sources: NVD: CVE-2022-45790 // JVNDB: JVNDB-2022-025065

AFFECTED PRODUCTS

vendor:	omron	model:	cj2h-cpu68-eip	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cj2h-cpu64	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cs1h-cpu66h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj1g-cpu44p	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cs1d-cpu67s	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cj2m-cpu34	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cs1g-cpu44h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj2h-cpu68	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cj2h-cpu67-eip	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cj1g-cpu45p-gtc	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj2h-cpu64-eip	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cj2h-cpu67	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cj2m-cpu33	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cs1h-cpu67h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cs1d-cpu67p	scope:	lt	version:	1.4	Trust: 1.0
vendor:	omron	model:	cs1g-cpu43h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj2m-cpu13	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cj2m-cpu12	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cj2m-cpu15	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cs1d-cpu42s	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cs1d-cpu44s	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cs1d-cpu65h	scope:	lt	version:	1.4	Trust: 1.0
vendor:	omron	model:	cs1d-cpu65p	scope:	lt	version:	1.4	Trust: 1.0
vendor:	omron	model:	cj2h-cpu66-eip	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cj2m-cpu31	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cp1e-e	scope:	lt	version:	1.3	Trust: 1.0
vendor:	omron	model:	cs1h-cpu65h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cp1e-n	scope:	lt	version:	1.3	Trust: 1.0
vendor:	omron	model:	cj2m-cpu11	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cj2h-cpu66	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cs1d-cpu67h	scope:	lt	version:	1.4	Trust: 1.0
vendor:	omron	model:	cj2m-cpu32	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cs1d-cpu65s	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cj2h-cpu65	scope:	lt	version:	1.5	Trust: 1.0
vendor:	omron	model:	cs1h-cpu64h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cs1h-cpu63h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cs1g-cpu45h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj2m-md211	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cj2m-cpu35	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cs1g-cpu42h	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj1g-cpu42p	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj2m-cpu14	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cj1g-cpu45p	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj1g-cpu43p	scope:	lt	version:	4.1	Trust: 1.0
vendor:	omron	model:	cj2m-md212	scope:	lt	version:	2.1	Trust: 1.0
vendor:	omron	model:	cj2h-cpu65-eip	scope:	lt	version:	1.5	Trust: 1.0
vendor:	オムロン株式会社	model:	cj2h-cpu64	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj1g-cpu44p	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj1g-cpu42p	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cp1e-e	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu67	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu66-eip	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj1g-cpu43p	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu65-eip	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2m-cpu34	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu66	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2m-cpu33	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2m-cpu35	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj1g-cpu45p	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj1g-cpu45p-gtc	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu68-eip	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu65	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu68	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cp1e-n	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu64-eip	scope:	-	version:	-	Trust: 0.8
vendor:	オムロン株式会社	model:	cj2h-cpu67-eip	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-025065 // NVD: CVE-2022-45790

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-45790
value:	CRITICAL
Trust: 1.0
ot-cert@dragos.com:	CVE-2022-45790
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-45790
value:	CRITICAL
Trust: 0.8

nvd@nist.gov:	CVE-2022-45790
baseSeverity:	CRITICAL
baseScore:	9.1
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	5.2
version:	3.1
Trust: 1.0
ot-cert@dragos.com:	CVE-2022-45790
baseSeverity:	HIGH
baseScore:	8.6
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	4.0
version:	3.1
Trust: 1.0
NVD:	CVE-2022-45790
baseSeverity:	CRITICAL
baseScore:	9.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2022-025065 // NVD: CVE-2022-45790 // NVD: CVE-2022-45790

PROBLEMTYPE DATA

problemtype:	CWE-307	Trust: 1.0
problemtype:	Inappropriate limitation of excessive authentication attempts (CWE-307) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2022-025065 // NVD: CVE-2022-45790

EXTERNAL IDS

db:	NVD	id:	CVE-2022-45790	Trust: 2.6
db:	ICS CERT	id:	ICSA-23-262-05	Trust: 1.8
db:	JVN	id:	JVNVU95526822	Trust: 0.8
db:	JVNDB	id:	JVNDB-2022-025065	Trust: 0.8

sources: JVNDB: JVNDB-2022-025065 // NVD: CVE-2022-45790

REFERENCES

url:	https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-05	Trust: 1.8
url:	https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/	Trust: 1.8
url:	https://www.fa.omron.co.jp/product/security/assets/pdf/en/omsr-2023-010_en.pdf	Trust: 1.8
url:	https://jvn.jp/vu/jvnvu95526822/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-45790	Trust: 0.8

sources: JVNDB: JVNDB-2022-025065 // NVD: CVE-2022-45790

SOURCES

db:	JVNDB	id:	JVNDB-2022-025065
db:	NVD	id:	CVE-2022-45790

LAST UPDATE DATE

2024-08-14T13:19:30.059000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2022-025065	date:	2024-02-06T02:07:00
db:	NVD	id:	CVE-2022-45790	date:	2024-01-29T16:37:48.967

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2022-025065	date:	2024-02-06T00:00:00
db:	NVD	id:	CVE-2022-45790	date:	2024-01-22T18:15:19.497