Risk Summary
Successful exploitation of these vulnerabilities could allow an attacker to bypass user memory protections by writing to a specific memory address. An attacker can also overwrite passwords and lock engineers from reading their own memory regions.
CVEs (1)
Remediations
- OMRON has released the following countermeasures for users to implement:
- Enable the hardware switch to prohibit writing UM (DIP switch on front panel of the CPU Unit)
- Set UM read protection password and “Prohibit from overwriting to a protected program “option.
- If the countermeasures cannot be applied, OMRON recommends that customers take the following mitigation measures:
- Security measures to prevent unauthorized access:
- If the following products and versions are used, the risk of attacks by an attacker via the network can be reduced by taking the following measures.
- Enable the FINS write protection function.
- Select the Protect by IP Address
- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.
- Implement firewalls (by shutting down unused communications ports, limiting communications hosts, limiting access to FINS port (9600)) and isolate them from the IT network.
- Use a virtual private network (VPN) for remote access to control systems and equipment.
- Use strong passwords and change them frequently.
- Install physical controls so that only authorized personnel can access control systems and equipment.
- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.
- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.
- Anti-virus protection: Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.
- Data input and output protection: Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.
- Data recovery: Periodical data backup and maintenance to prepare for data loss.
Affected Vendors
Omron
Affected Products (23)
Omron
·
CJ2H-CPU6 □ -EIP
vers:all/*
Omron
·
CJ2H-CPU6 □
vers:all/*
Omron
·
CJ2M-CPU □ □
vers:all/*
Omron
·
CJ1G-CPU □ □ P
vers:all/*
Omron
·
CS1H-CPU □ □ H
vers:all/*
Omron
·
CS1G-CPU □ □ H
vers:all/*
Omron
·
CS1D-CPU □ □ HA
vers:all/*
Omron
·
CS1D-CPU □ □ H
vers:all/*
Omron
·
CS1D-CPU □ □ SA
vers:all/*
Omron
·
CS1D-CPU □ □ S
vers:all/*
Omron
·
CS1D-CPU □ □ P
vers:all/*
Omron
·
CP2E-E □ □ D □ - □
vers:all/*
Omron
·
CP2E-S □ □ D □- □
vers:all/*
Omron
·
CP2E-N □ □ D □ - □
vers:all/*
Omron
·
CP1H-X40D □ - □
vers:all/*
Omron
·
CP1H-XA40D □ - □
vers:all/*
Omron
·
CP1H-Y20DT-D
vers:all/*
Omron
·
CP1L-EL20D □ - □
vers:all/*
Omron
·
CP1L-EM □ □ D □ - □
vers:all/*
Omron
·
CP1L-L □ □ D □- □
vers:all/*
Omron
·
CP1L-M □ □ D □ - □
vers:all/*
Omron
·
CP1E-E □ □ D □ - □
vers:all/*
Omron
·
CP1E-NA □ □ D □ - □
vers:all/*
Affected Sectors
Critical Manufacturing
Get alerted to advisories like this
OTWarden monitors CISA, BSI, Siemens, Rockwell and more — and emails you within 2 hours when your vendors are affected.
Start free trial Learn more