7.5
HIGH
CVE-2024-33687
Schneider NX/NJ Series CPU Unit Data Authentication Bypass Vulnerability
Description

Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.

INFO

Published Date :

June 24, 2024, 3:15 p.m.

Last Modified :

June 26, 2024, 2:12 p.m.

Source :

[email protected]

Remotely Exploitable :

Yes !

Impact Score :

3.6

Exploitability Score :

3.9
Affected Products

The following products are affected by CVE-2024-33687 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Omron nj501-1500_firmware
2 Omron nj501-1400_firmware
3 Omron nj501-1300_firmware
4 Omron nj-pa3001_firmware
5 Omron nj-pd3001_firmware
6 Omron nj501-r400_firmware
7 Omron nj501-r420_firmware
8 Omron nj501-r300_firmware
9 Omron nj501-r320_firmware
10 Omron nj501-r520_firmware
11 Omron nj501-r500_firmware
12 Omron nj501-5300_firmware
13 Omron nj501-1520_firmware
14 Omron nj501-1420_firmware
15 Omron nj501-1320_firmware
16 Omron nj101-1020_firmware
17 Omron nj101-9020_firmware
18 Omron nj501-1340_firmware
19 Omron nj501-4400_firmware
20 Omron nj501-4300_firmware
21 Omron nj501-4500_firmware
22 Omron nj501-4310_firmware
23 Omron nj501-4320_firmware
24 Omron nj301-1200_firmware
25 Omron nj301-1100_firmware
26 Omron nj101-1000_firmware
27 Omron nj101-9000_firmware
28 Omron nx1p2-1140dt_firmware
29 Omron nx1p2-1140dt1_firmware
30 Omron nx1p2-1040dt_firmware
31 Omron nx1p2-1040dt1_firmware
32 Omron nx1p2-9024dt_firmware
33 Omron nx1p2-9024dt1_firmware
34 Omron nx102-1200_firmware
35 Omron nx102-1100_firmware
36 Omron nx102-1000_firmware
37 Omron nx102-9000_firmware
38 Omron nx102-1220_firmware
39 Omron nx102-1120_firmware
40 Omron nx102-1020_firmware
41 Omron nx102-9020_firmware
42 Omron nx701-1720_firmware
43 Omron nx701-1620_firmware
44 Omron nx701-1600_firmware
45 Omron nx701-1700_firmware
46 Omron nx701-z700_firmware
47 Omron nx701-z600_firmware
48 Omron nx1w-cif01_firmware
49 Omron nx1w-cif11_firmware
50 Omron nx1w-cif12_firmware
51 Omron nx1w-adb21_firmware
52 Omron nx1w-dab21v_firmware
53 Omron nx1w-mab221_firmware
54 Omron nj501-140_firmware
55 Omron nj501-5300-1_firmware
56 Omron nj101-1000
57 Omron nj101-1020
58 Omron nj101-9000
59 Omron nj101-9020
60 Omron nj301-1100
61 Omron nj301-1200
62 Omron nj501-1300
63 Omron nj501-1320
64 Omron nj501-1340
65 Omron nj501-140
66 Omron nj501-1400
67 Omron nj501-1420
68 Omron nj501-1500
69 Omron nj501-1520
70 Omron nj501-4300
71 Omron nj501-4310
72 Omron nj501-4320
73 Omron nj501-4400
74 Omron nj501-4500
75 Omron nj501-5300
76 Omron nj501-5300-1
77 Omron nj501-r300
78 Omron nj501-r320
79 Omron nj501-r400
80 Omron nj501-r420
81 Omron nj501-r500
82 Omron nj501-r520
83 Omron nj-pa3001
84 Omron nj-pd3001
85 Omron nx102-1000
86 Omron nx102-1020
87 Omron nx102-1100
88 Omron nx102-1120
89 Omron nx102-1200
90 Omron nx102-1220
91 Omron nx102-9000
92 Omron nx102-9020
93 Omron nx1p2-1040dt
94 Omron nx1p2-1040dt1
95 Omron nx1p2-1140dt
96 Omron nx1p2-1140dt1
97 Omron nx1p2-9024dt
98 Omron nx1p2-9024dt1
99 Omron nx1w-adb21
100 Omron nx1w-cif01
101 Omron nx1w-cif11
102 Omron nx1w-cif12
103 Omron nx1w-dab21v
104 Omron nx1w-mab221
105 Omron nx701-1600
106 Omron nx701-1620
107 Omron nx701-1700
108 Omron nx701-1720
109 Omron nx701-z600
110 Omron nx701-z700
: Total Affected Vendor : 1 | Products : 110
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-33687.

URL Resource
https://jvn.jp/en/vu/JVNVU92504444/ Third Party Advisory
https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-004_en.pdf Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-33687 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2024-33687 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Jun. 26, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    Changed Reference Type https://jvn.jp/en/vu/JVNVU92504444/ No Types Assigned https://jvn.jp/en/vu/JVNVU92504444/ Third Party Advisory
    Changed Reference Type https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-004_en.pdf No Types Assigned https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-004_en.pdf Vendor Advisory
    Added CWE NIST CWE-345
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-1000_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj101-1000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-1020_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj101-1020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-9000_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj101-9000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj101-9020_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj101-9020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj301-1100_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj301-1100:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj301-1200_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj301-1200:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1300_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-1300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1320_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-1320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1340_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-1340:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-140_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-140:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1400_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-1400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1420_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-1420:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1500_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-1500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-1520_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-1520:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4300_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-4300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4310_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-4310:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4320_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-4320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4400_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-4400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-4500_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-4500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-5300_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-5300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-5300-1_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-5300-1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r300_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-r300:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r320_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-r320:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r400_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-r400:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r420_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-r420:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r500_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-r500:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj501-r520_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj501-r520:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj-pa3001_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj-pa3001:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nj-pd3001_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nj-pd3001:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1000_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx102-1000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1020_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx102-1020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1100_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx102-1100:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1120_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx102-1120:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1200_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx102-1200:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-1220_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx102-1220:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-9000_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx102-9000:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx102-9020_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx102-9020:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1040dt_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1p2-1040dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1040dt1_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1p2-1040dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1140dt_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1p2-1140dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-1140dt1_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1p2-1140dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-9024dt_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1p2-9024dt:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1p2-9024dt1_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1p2-9024dt1:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-adb21_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1w-adb21:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif01_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1w-cif01:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif11_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1w-cif11:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-cif12_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1w-cif12:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-dab21v_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1w-dab21v:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx1w-mab221_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx1w-mab221:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1600_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx701-1600:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1620_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx701-1620:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1700_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx701-1700:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-1720_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx701-1720:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-z600_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx701-z600:-:*:*:*:*:*:*:*
    Added CPE Configuration AND OR *cpe:2.3:o:omron:nx701-z700_firmware:*:*:*:*:*:*:*:* OR cpe:2.3:h:omron:nx701-z700:-:*:*:*:*:*:*:*
  • CVE Received by [email protected]

    Jun. 24, 2024

    Action Type Old Value New Value
    Added Description Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.
    Added Reference JPCERT/CC https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-004_en.pdf [No types assigned]
    Added Reference JPCERT/CC https://jvn.jp/en/vu/JVNVU92504444/ [No types assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-33687 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-33687 weaknesses.

CAPEC-111: JSON Hijacking (aka JavaScript Hijacking) JSON Hijacking (aka JavaScript Hijacking) CAPEC-141: Cache Poisoning Cache Poisoning CAPEC-142: DNS Cache Poisoning DNS Cache Poisoning CAPEC-148: Content Spoofing Content Spoofing CAPEC-218: Spoofing of UDDI/ebXML Messages Spoofing of UDDI/ebXML Messages CAPEC-384: Application API Message Manipulation via Man-in-the-Middle Application API Message Manipulation via Man-in-the-Middle CAPEC-385: Transaction or Event Tampering via Application API Manipulation Transaction or Event Tampering via Application API Manipulation CAPEC-386: Application API Navigation Remapping Application API Navigation Remapping CAPEC-387: Navigation Remapping To Propagate Malicious Content Navigation Remapping To Propagate Malicious Content CAPEC-388: Application API Button Hijacking Application API Button Hijacking CAPEC-665: Exploitation of Thunderbolt Protection Flaws Exploitation of Thunderbolt Protection Flaws CAPEC-701: Browser in the Middle (BiTM) Browser in the Middle (BiTM)
CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: