JVNVU#92193064
OMRON CJ series and CS/CJ Series EtherNet/IT unit vulnerable to Denial-of-Service (DoS)
Overview
Denial-of-service (DoS) vulnerability exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit provided by OMRON Corporation.
Products Affected
- CJ2M CPU Unit
- CJ2M-CPU3[] Unit version of the built-in EtherNet/IP™ section Ver. 2.18 and earlier
- CJ2H CPU Unit
- CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier
- CS/CJ Series EtherNet/IP Unit
- CS1W-EIP21 V3.04 and earlier
- CJ1W-EIP21 V3.04 and earlier
- CJ Series CPU Unit User's Manual (Hardware) (W472-E1-15) “Unit Versions of CJ2 CPU Units” section
- CS/CJ Series EtherNet/IP Units Operation Manual (W465-E1-12) “Unit Versions of CS/CJ-series” section
Description
Denial-of-service (DoS) vulnerability due to improper validation of specified type of input (CWE-1287) issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit provided by OMRON Corporation.
Impact
If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition.
Solution
Update the firmware
Update the firmware to the latest version according to the information provided by the developer.
Regarding the details of how to obtain the update or how to update the firmware, contact the developer and/or the sales representatives.
Vendor Status
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
Credit
OMRON Corporation reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2023-38744 |
| JVN iPedia |
|