dbcve.org
Sysmac Cs1 FirmwareOperating system · Omron

CVE-2022-31205

HIGH · 7.5 CVSS v3.1 Published 2022-07-26
Fix available
A fix is available. Upgrade to 1.5 / 1.10 or later.
See remediation →
84/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

In Omron CS, CJ, and CP series PLCs, the Web UI password is stored in memory addresses D1449-D1452 and can be read via the Omron FINS protocol without any authentication, allowing unauthenticated attackers to obtain plaintext credentials.

MitigationRestrict network access to PLCs using firewalls/VLANs, apply vendor firmware updates when available, and monitor FINS protocol traffic for unauthorized access attempts.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Sysmac Cs1 FirmwareOperating system
Affected:< 4.1
Sysmac Cj2m FirmwareOperating system
Affected:< 2.1
Sysmac Cj2h FirmwareOperating system
Affected:< 1.5
Sysmac Cp1e FirmwareOperating system
Affected:< 1.30
Sysmac Cp1h FirmwareOperating system
Affected:< 1.30
Sysmac Cp1l FirmwareOperating system
Affected:< 1.10
Cp1w Cif41 FirmwareOperating system
Affected:all versions

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify PLC model and firmware version
    Connect to the PLC via Sysmac Studio or check the PLC unit label to determine the exact model (CS1, CJ2m, CJ2h, CP1e, CP1h, CP1l, or Cp1w-cif41). Then access the PLC programming software or web interface to retrieve the current firmware version.
    Affected if The PLC model is one of the affected series (CS1, CJ2m, CJ2h, CP1e, CP1h, Cp1l) with firmware version below 4.1, 2.1, 1.5, 1.30, 1.30, or 1.10 respectively, or if the model is Cp1w-cif41 at any version.
  2. Verify FINS protocol accessibility
    Check network configuration to determine if UDP/TCP port 9600 (FINS protocol default port) is exposed to untrusted networks. Use network scanning tools to detect if the PLC is accepting FINS connections from unauthorized IP addresses.
    Affected if The FINS protocol port (9600) is accessible from network segments that contain untrusted or attacker-controlled systems.
  3. Confirm Web UI is enabled
    Access the PLC web interface via HTTP/HTTPS if configured, or check PLC settings in Sysmac Studio to determine if the built-in web server feature is enabled.
    Affected if The PLC web interface is enabled, as the vulnerability involves reading password data stored for web authentication.
  4. Test read access to memory addresses D1449-D1452
    Send a FINS protocol memory area read request (FINS command MEMORY AREA READ) targeting DM word addresses D1449 through D1452. Use a FINS client tool or custom script to issue the command without authentication.
    Affected if The FINS protocol returns valid data from memory addresses D1449-D1452 without requiring authentication, indicating the plaintext password can be retrieved.

You are affected if you operate any Omron CS, CJ, or CP series PLC with a vulnerable firmware version (or any version of Cp1w-cif41) where the FINS protocol is network-accessible and memory addresses D1449-D1452 can be read without authentication.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 1.5 / 1.10 / 1.30 or later
Fixed in 1.51.101.30
Interim mitigation

Restrict network access to PLCs using firewalls/VLANs, apply vendor firmware updates when available, and monitor FINS protocol traffic for unauthorized access attempts.

Recommended fix Moderate confidence

Upgrade to firmware version 4.1 (CS1), 2.1 (CJ2M), 1.5 (CJ2H), 1.30 (CP1E/CP1H), or 1.10 (CP1L). Cp1w Cif41 has no available fix.

  1. 1. Identify the specific Omron PLC model (CS1, CJ2M, CJ2H, CP1E, CP1H, CP1L, or CP1W-CIF41) in your environment
  2. 2. Determine the current firmware version of the affected PLC
  3. 3. For Sysmac CS1 PLCs: Upgrade firmware to version 4.1 or later
  4. 4. For Sysmac CJ2M PLCs: Upgrade firmware to version 2.1 or later
  5. 5. For Sysmac CJ2H PLCs: Upgrade firmware to version 1.5 or later
  6. 6. For Sysmac CP1E PLCs: Upgrade firmware to version 1.30 or later
  7. 7. For Sysmac CP1H PLCs: Upgrade firmware to version 1.30 or later
  8. 8. For Sysmac CP1L PLCs: Upgrade firmware to version 1.10 or later
Caveat Cp1w Cif41 has no firmware fix available - contact vendor for alternative mitigations. Standard PLC firmware upgrade procedures apply; ensure backup before updating.

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Sysmac Cs1 Firmware Scoped from the published advisory
  • Consultation6.0 h
  • Implementation12.0 h
  • Testing8.0 h
  • Review / QA4.0 h
30.0 hours of engineering $5,280
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $8,448.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-31205 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-31205 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data