Lucene search

IcscertCVE-2019-18261

HistoryDec 16, 2019 - 8:15 p.m.

CVE-2019-18261

2019-12-1620:15:15

CWE-307

icscert

web.nvd.nist.gov

cve-2019-18261

omron

plc

cs series

cj series

nj series

authentication

brute force attacks

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

59.6%

JSON

In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

Affected configurations

Nvd

Node

omronplc_cj_firmware

omronplc_cs_firmware

omronplc_nj_firmware

VendorProductVersionCPE
omronplc_cj_firmware*cpe:2.3:o:omron:plc_cj_firmware:*:*:*:*:*:*:*:*
omronplc_cs_firmware*cpe:2.3:o:omron:plc_cs_firmware:*:*:*:*:*:*:*:*
omronplc_nj_firmware*cpe:2.3:o:omron:plc_nj_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
omron	plc_cj_firmware	*	cpe:2.3:o:omron:plc_cj_firmware::::::::
omron	plc_cs_firmware	*	cpe:2.3:o:omron:plc_cs_firmware::::::::
omron	plc_nj_firmware	*	cpe:2.3:o:omron:plc_nj_firmware::::::::

CNA Affected

[
  {
    "product": "Omron PLC CJ, CS and NJ Series",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Omron PLC CS series, all versions, Omron PLC CJ series, all versions, Omron PLC NJ series, all versions"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsa-19-346-03

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.002

Percentile

59.6%

JSON

Related for CVE-2019-18261