[Japanese]

JVNDB-2022-001384

Multiple vulnerabilities in OMRON CX-Programmer

Overview

CX-Programmer provided by OMRON Corporation contains multiple vulnerabilities listed below.

* Out-of-bounds Write (CWE-787) - CVE-2022-21124
* Use After Free (CWE-416) - CVE-2022-25230
* Use After Free (CWE-416) - CVE-2022-25325
* Out-of-bounds Read (CWE-125) - CVE-2022-21219
* Out-of-bounds Write (CWE-787) - CVE-2022-25234

Michael Heinzl reported these vulnerabilities to JPCERT/CC.
JPCERT/CC coordinated with the developer.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS V2 Severity:
Base Metrics 6.8 (Medium) [NVD Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
The above CVSS base scores have been assigned for CVE-2022-21124

CVSS V3 Severity:
Base Metrics:7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2022-25230

CVSS V3 Severity:
Base Metrics:7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2022-25325

CVSS V3 Severity:
Base Metrics:7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2022-21219

CVSS V3 Severity:
Base Metrics:7.8 (High) [Other]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
The above CVSS base scores have been assigned for CVE-2022-25234
Affected Products


OMRON Corporation
  • CX-One v9.76.1 and earlier which is a part of CX-One (v4.60) suite

Impact

By having a user to open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
Solution

[Update the Software]
Update for CX-One suite is applied by its Auto Update function, therefore it is not necessary for the users to take any actions.
The developer recommends the users to contact the developer and/or the sales representatives if there are any issues with Auto Update.
The version that contains the fix for this vulnerability is as follows.

* CX-Programmer Ver.9.77

For more information, refer to the information provided by the developer.
Vendor Information

OMRON Corporation
CWE (What is CWE?)

  1. Out-of-bounds Read(CWE-125) [Other]
  2. Use After Free(CWE-416) [Other]
  3. Out-of-bounds Write(CWE-787) [Other]
CVE (What is CVE?)

  1. CVE-2022-21124
  2. CVE-2022-25230
  3. CVE-2022-25325
  4. CVE-2022-21219
  5. CVE-2022-25234
References

  1. JVN : JVNVU#90121984
  2. National Vulnerability Database (NVD) : CVE-2022-21124
  3. National Vulnerability Database (NVD) : CVE-2022-21219
  4. National Vulnerability Database (NVD) : CVE-2022-25230
  5. National Vulnerability Database (NVD) : CVE-2022-25234
  6. National Vulnerability Database (NVD) : CVE-2022-25325
Revision History

  • [2022/03/08]
      Web page was published
  • [2024/06/20]
      CVSS Severity was modified
      References : Contents were added

Date Public2022/03/04
Date First Published2022/03/08
Date Last Updated2024/06/21