7.5
HIGH
CVE-2022-33971
OMRON Machine Automation Controller Authentication Bypass
Description

Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.

INFO

Published Date :

July 4, 2022, 2:15 a.m.

Last Modified :

Nov. 21, 2024, 7:08 a.m.

Source :

[email protected]

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.6
Affected Products

The following products are affected by CVE-2022-33971 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Omron nj501-1500_firmware
2 Omron nj501-1300_firmware
3 Omron nj-pa3001_firmware
4 Omron nj-pd3001_firmware
5 Omron nj501-r400_firmware
6 Omron nj501-r420_firmware
7 Omron nj501-r300_firmware
8 Omron nj501-r320_firmware
9 Omron nj501-r520_firmware
10 Omron nj501-r500_firmware
11 Omron nj501-5300_firmware
12 Omron nj501-1520_firmware
13 Omron nj501-1420_firmware
14 Omron nj501-1320_firmware
15 Omron nj101-1020_firmware
16 Omron nj101-9020_firmware
17 Omron nj501-1340_firmware
18 Omron nj501-4400_firmware
19 Omron nj501-4300_firmware
20 Omron nj501-4500_firmware
21 Omron nj501-4310_firmware
22 Omron nj501-4320_firmware
23 Omron nj301-1200_firmware
24 Omron nj301-1100_firmware
25 Omron nj101-1000_firmware
26 Omron nj101-9000_firmware
27 Omron nx1p2-1140dt_firmware
28 Omron nx1p2-1140dt1_firmware
29 Omron nx1p2-1040dt_firmware
30 Omron nx1p2-1040dt1_firmware
31 Omron nx1p2-9024dt_firmware
32 Omron nx1p2-9024dt1_firmware
33 Omron nx102-1200_firmware
34 Omron nx102-1100_firmware
35 Omron nx102-1000_firmware
36 Omron nx102-1220_firmware
37 Omron nx102-1120_firmware
38 Omron nx102-1020_firmware
39 Omron nx102-9020_firmware
40 Omron nx701-1720_firmware
41 Omron nx701-1620_firmware
42 Omron nx701-1600_firmware
43 Omron nx701-1700_firmware
44 Omron nx701-z700_firmware
45 Omron nx701-z600_firmware
46 Omron nx1w-cif01_firmware
47 Omron nx1w-cif11_firmware
48 Omron nx1w-cif12_firmware
49 Omron nx1w-adb21_firmware
50 Omron nx1w-dab21v_firmware
51 Omron nx1w-mab221_firmware
52 Omron nj501-140_firmware
53 Omron nj101-1000
54 Omron nj101-1020
55 Omron nj101-9000
56 Omron nj101-9020
57 Omron nj301-1100
58 Omron nj301-1200
59 Omron nj501-1300
60 Omron nj501-1320
61 Omron nj501-1340
62 Omron nj501-140
63 Omron nj501-1420
64 Omron nj501-1500
65 Omron nj501-1520
66 Omron nj501-4300
67 Omron nj501-4310
68 Omron nj501-4320
69 Omron nj501-4400
70 Omron nj501-4500
71 Omron nj501-5300
72 Omron nj501-r300
73 Omron nj501-r320
74 Omron nj501-r400
75 Omron nj501-r420
76 Omron nj501-r500
77 Omron nj501-r520
78 Omron nj-pa3001
79 Omron nj-pd3001
80 Omron nx102-1000
81 Omron nx102-1020
82 Omron nx102-1100
83 Omron nx102-1120
84 Omron nx102-1200
85 Omron nx102-1220
86 Omron nx102-9020
87 Omron nx1p2-1040dt
88 Omron nx1p2-1040dt1
89 Omron nx1p2-1140dt
90 Omron nx1p2-1140dt1
91 Omron nx1p2-9024dt
92 Omron nx1p2-9024dt1
93 Omron nx1w-adb21
94 Omron nx1w-cif01
95 Omron nx1w-cif11
96 Omron nx1w-cif12
97 Omron nx1w-dab21v
98 Omron nx1w-mab221
99 Omron nx701-1600
100 Omron nx701-1620
101 Omron nx701-1700
102 Omron nx701-1720
103 Omron nx701-z600
104 Omron nx701-z700
: Total Affected Vendor : 1 | Products : 104
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2022-33971.

URL Resource
https://jvn.jp/en/vu/JVNVU97050784/index.html Third Party Advisory VDB Entry
https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf Mitigation Vendor Advisory
https://jvn.jp/en/vu/JVNVU97050784/index.html Third Party Advisory VDB Entry
https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf Mitigation Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2022-33971 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2022-33971 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://jvn.jp/en/vu/JVNVU97050784/index.html
    Added Reference https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Initial Analysis by [email protected]

    Jul. 15, 2022

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:A/AC:M/Au:N/C:P/I:P/A:P)
    Added CVSS V3.1 NIST AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://jvn.jp/en/vu/JVNVU97050784/index.html No Types Assigned https://jvn.jp/en/vu/JVNVU97050784/index.html Third Party Advisory, VDB Entry
    Changed Reference Type https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf No Types Assigned https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf Mitigation, Vendor Advisory
    Added CWE NIST CWE-294
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1600_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-1600:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1700_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-1700:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-z700_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-z700:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-z600_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-z600:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1720_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-1720:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1620_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-1620:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1200_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1200:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1100_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1100:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1000_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1220_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1220:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1120_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1120:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1020_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-9020_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-9020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1140dt_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-1140dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1140dt1_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-1140dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1040dt_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-1040dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1040dt1_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-1040dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-9024dt_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-9024dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-9024dt1_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-9024dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif01_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-cif01:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif11_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-cif11:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif12_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-cif12:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-adb21_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-adb21:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-dab21v_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-dab21v:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-mab221_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-mab221:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1500_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-140_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-140:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1300_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r500_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r520_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r520:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r400_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r420_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r420:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r300_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r320_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-5300_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-5300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1520_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1520:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1420_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1420:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1320_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-1020_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj101-1020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-9020_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj101-9020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1340_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1340:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4500_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4400_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4300_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4310_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4310:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4320_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj301-1200_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.48 OR cpe:2.3:h:omron:nj301-1200:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj301-1100_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj301-1100:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-1000_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj101-1000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-9000_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj101-9000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj-pa3001_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj-pa3001:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj-pd3001_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj-pd3001:-:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.08 }} 0.01%

score

0.35224

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: