7.5
HIGH
CVE-2022-33971
OMRON Machine Automation Controller Authentication Bypass
Description

Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.

INFO

Published Date :

July 4, 2022, 2:15 a.m.

Last Modified :

July 15, 2022, 5:12 p.m.

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

1.6
Affected Products

The following products are affected by CVE-2022-33971 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Omron nj501-1500_firmware
2 Omron nj501-1300_firmware
3 Omron nj-pa3001_firmware
4 Omron nj-pd3001_firmware
5 Omron nj501-r400_firmware
6 Omron nj501-r420_firmware
7 Omron nj501-r300_firmware
8 Omron nj501-r320_firmware
9 Omron nj501-r520_firmware
10 Omron nj501-r500_firmware
11 Omron nj501-5300_firmware
12 Omron nj501-1520_firmware
13 Omron nj501-1420_firmware
14 Omron nj501-1320_firmware
15 Omron nj101-1020_firmware
16 Omron nj101-9020_firmware
17 Omron nj501-1340_firmware
18 Omron nj501-4400_firmware
19 Omron nj501-4300_firmware
20 Omron nj501-4500_firmware
21 Omron nj501-4310_firmware
22 Omron nj501-4320_firmware
23 Omron nj301-1200_firmware
24 Omron nj301-1100_firmware
25 Omron nj101-1000_firmware
26 Omron nj101-9000_firmware
27 Omron nx1p2-1140dt_firmware
28 Omron nx1p2-1140dt1_firmware
29 Omron nx1p2-1040dt_firmware
30 Omron nx1p2-1040dt1_firmware
31 Omron nx1p2-9024dt_firmware
32 Omron nx1p2-9024dt1_firmware
33 Omron nx102-1200_firmware
34 Omron nx102-1100_firmware
35 Omron nx102-1000_firmware
36 Omron nx102-1220_firmware
37 Omron nx102-1120_firmware
38 Omron nx102-1020_firmware
39 Omron nx102-9020_firmware
40 Omron nx701-1720_firmware
41 Omron nx701-1620_firmware
42 Omron nx701-1600_firmware
43 Omron nx701-1700_firmware
44 Omron nx701-z700_firmware
45 Omron nx701-z600_firmware
46 Omron nx1w-cif01_firmware
47 Omron nx1w-cif11_firmware
48 Omron nx1w-cif12_firmware
49 Omron nx1w-adb21_firmware
50 Omron nx1w-dab21v_firmware
51 Omron nx1w-mab221_firmware
52 Omron nj501-140_firmware
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2022-33971.

URL Resource
https://jvn.jp/en/vu/JVNVU97050784/index.html Third Party Advisory VDB Entry
https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf Mitigation Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2022-33971 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2022-33971 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Initial Analysis by [email protected]

    Jul. 15, 2022

    Action Type Old Value New Value
    Added CVSS V2 NIST (AV:A/AC:M/Au:N/C:P/I:P/A:P)
    Added CVSS V3.1 NIST AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://jvn.jp/en/vu/JVNVU97050784/index.html No Types Assigned https://jvn.jp/en/vu/JVNVU97050784/index.html Third Party Advisory, VDB Entry
    Changed Reference Type https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf No Types Assigned https://www.ia.omron.com/product/vulnerability/OMSR-2022-002_en.pdf Mitigation, Vendor Advisory
    Added CWE NIST CWE-294
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1600_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-1600:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1700_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-1700:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-z700_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-z700:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-z600_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-z600:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1720_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-1720:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1620_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.28 OR cpe:2.3:h:omron:nx701-1620:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1200_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1200:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1100_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1100:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1000_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1220_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1220:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1120_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1120:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1020_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-1020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-9020_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx102-9020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1140dt_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-1140dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1140dt1_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-1140dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1040dt_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-1040dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1040dt1_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-1040dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-9024dt_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-9024dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-9024dt1_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1p2-9024dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif01_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-cif01:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif11_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-cif11:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif12_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-cif12:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-adb21_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-adb21:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-dab21v_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-dab21v:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-mab221_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nx1w-mab221:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1500_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-140_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-140:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1300_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r500_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r520_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r520:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r400_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r420_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r420:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r300_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r320_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-r320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-5300_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-5300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1520_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1520:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1420_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1420:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1320_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-1020_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj101-1020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-9020_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj101-9020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1340_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-1340:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4500_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4400_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4300_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4310_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4310:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4320_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj501-4320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj301-1200_firmware:*:*:*:*:*:*:*:* versions up to (excluding) 1.48 OR cpe:2.3:h:omron:nj301-1200:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj301-1100_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj301-1100:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-1000_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj101-1000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-9000_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj101-9000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj-pa3001_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj-pa3001:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj-pd3001_firmware:*:*:*:*:*:*:*:* versions up to (including) 1.48 OR cpe:2.3:h:omron:nj-pd3001:-:*:*:*:*:*:*:*
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.07 }} 0.00%

score

0.29047

percentile

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability