Published: 2022/12/19  Last Updated: 2022/12/19

Information from OMRON Corporation

Vulnerability ID:JVNVU#92689335
Title:Use-after-free vulnerability in Omron CX-Drive

This is a statement from the vendor itself with no modification by JPCERT/CC.

 Use After Free (CWE-416) vulnerability exists in the Inverter/Servo Support Software CX-Drive. If a legitimate user opens a malicious file created using this vulnerability, an attacker may use this vulnerability to execute arbitrary code.
 The products and versions affected by this vulnerability, mitigation and protection measures are shown below. Make sure to implement these recommended mitigations and protections to minimize the risk of exploitation of this vulnerability.

■Affected products
Affected products and versions are as follows.
  ・CX-Drive v3.00 or lower

 Refer to the following manual for how to check the target product version.

■CVSS Scores
 Use After Free (CWE-416)
 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Base Score 7.8

■Mitigations and Protections
 OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of the vulnerability.

 1.Anti-virus protection
  Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.

 2.Security measures to prevent unauthorized access
  a)Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.
  b)Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.
  c)Use a virtual private network (VPN) for remote access to control systems and equipment.
  d)Use strong passwords and change them frequently.
  e)Install physical controls so that only authorized personnel can access control systems and equipment.
  f)Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.
  g)Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.

3.Data input and output protection
 Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.

4.Data recovery
 Periodical data backup and maintenance to prepare for data loss.

5.Adoption of new software tools and controllers
 Automation software Sysmac Studio
 Controller NJ/NX/NY Series

 Mr. Michael Heinzl reported us this vulnerability via JPCERT/CC.
 Many thanks to Mr. Michael Heinzl.

■Update history
December 19, 2022 New Release