CVE-2023-0811CWE-284

Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored

Critical · published March 16, 2023

CVSS v3.1
9.1
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

🚨 A crafty command can let attackers rewrite the very password protecting your Omron CJ1M unit! 🔥 Think of it like a hotel receptionist changing the master key without permission — suddenly, anyone could access all the rooms without a trace. 🎭 This vulnerability could result in an attacker disabling critical protections, leaving your user programs vulnerable to tampering. Imagine losing control over your own systems, or worse, having a non-standard password set that locks out engineers from making essential modifications!

Put simply

Think of it like a hotel receptionist changing the master key without permission — suddenly, anyone could access all the rooms without a trace. 🎭 The Omron CJ1M unit v4.0 and prior has improper access controls on the memory region storing the UM password, allowing an adversary to issue a PROGRAM AREA WRITE command to overwrite the password, effectively bypassing security measures.

What to do

This vulnerability could result in an attacker disabling critical protections, leaving your user programs vulnerable to tampering. Imagine losing control over your own systems, or worse, having a non-standard password set that locks out engineers from making essential modifications! Update your Omron CJ1M unit to a version beyond 4.0 to close this gap. Additionally, review your access controls to ensure no unauthorized commands can reach critical memory areas. Regularly audit your system for anomalies to catch any suspicious activity early! You can tackle this issue head-on and secure your systems back to hero status! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2023-03-16T17:41Z
EPSS history
Timeline
  • 16 MAR 17:41Z
    Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored
    cvelistv5