Information from OMRON Corporation

Active Debug Code vulnerability in Programable controller CP1L series


Release date: Jan 11, 2023
OMRON Corporation

■Overview
　Active Debug Code (CWE-798) exists in Programable controller CP1L series. An attacker may use the vulnerability to read and write arbitrary areas of device memory, resulting in theft of memory contents, denial of service (DoS), and execution of arbitrary code.
　The products and versions affected by this vulnerability, countermeasures, mitigations are shown below. Make sure to implement these recommended countermeasures and mitigations to minimize the risk of exploitation of this vulnerability.

■Affected products
Affected products and versions are as follows.
　　・Programable controller CP1L series CP1L-EL20DR-D All version
　　　* Ver1.1 or later has a countermeasure function for this vulnerability. For details, please check the countermeasures below.

　Refer to the following manual for how to check the target product version.
　　・ CP1L-EL/EM CPU Unit OPERATION MANUAL(W516-E1-05）
　　　Refer to “Unit Versions of CP-series CPU Units”

■Description
　Active debug code (CWE-798) exists in Programable controller CP1L series.

■Potential threats and impacts
　An attacker may use the vulnerability to read and write arbitrary areas of device memory, resulting in theft of memory contents, denial of service (DoS), and execution of arbitrary code.


■CVSS Scores
　Active Debug Code（CWE-489）
　CVE-2023-22357
　CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Base Score 9.1

■Countermeasures
　The programmable controller Unit Ver.1.1 or later and CX-Programmer Ver.9.6 or later, this vulnerability can be countered by enabling “Extend protection password” function of UM read protection and task read protection.
　Refer to the following manual for how to enable the function.
　　・ CP1L-EL/EM CPU Unit OPERATION MANUAL(W516-E1-05）
　　　Refer to “8-7 Program Protection”

■Mitigations
　OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.

　1. Anti-virus protection
　　Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.

2. Security measures to prevent unauthorized access
　　- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.
　　- Implement firewalls (by shutting down unused communications ports, limiting communications hosts, FINS port 9600) and isolate them from the IT network.
　　- Use a virtual private network (VPN) for remote access to control systems and equipment.
　　- Use strong passwords and change them frequently.
　　- Install physical controls so that only authorized personnel can access control systems and equipment.
　　- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.
　　- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.

　3. Data input and output protection
　　Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.
　4. Data recovery
Periodical data backup and maintenance to prepare for data loss.

■Contact information
　Please contact our sales office or distributors.
　https://www.ia.omron.com/global_network/index.html

■Acknowledgments
　Georgy Kiguradze of Positive Technologies reported us this vulnerability via JPCERT/CC.
　Many thanks to Georgy Kiguradze.

■Update history
Jan 11, 2023: New Release