CVE-2019-18269

Description

Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.

Workaround:

Omron recommends the following mitigation measures: * Filter FINS port: Protect access to Omron’s PLC with a firewall and blocking unnecessary remote access to FINS port (default: 9600). * Filter IP addresses: Protect access to Omron’s PLC with a firewall and filtering devices connected to the PLC by IP address. For more information provided by Omron on these vulnerabilities refer to Vulnerabilities in Omron CS and CJ series CPU PLCs https://gcc01.safelinks.protection.outlook.com/ .

Link	Tags
https://www.us-cert.gov/ics/advisories/icsa-19-346-02	third party advisory us government resource
https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf

What is the severity of CVE-2019-18269?: CVE-2019-18269 has been scored as a critical severity vulnerability.
How to fix CVE-2019-18269?: As a workaround for remediating CVE-2019-18269: Omron recommends the following mitigation measures: * Filter FINS port: Protect access to Omron’s PLC with a firewall and blocking unnecessary remote access to FINS port (default: 9600). * Filter IP addresses: Protect access to Omron’s PLC with a firewall and filtering devices connected to the PLC by IP address. For more information provided by Omron on these vulnerabilities refer to Vulnerabilities in Omron CS and CJ series CPU PLCs https://gcc01.safelinks.protection.outlook.com/ .
Is CVE-2019-18269 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2019-18269 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-18269?: CVE-2019-18269 affects Omron Omron PLC CJ Series, Omron Omron PLC CS series, Omron Omron PLC NX1P2 series.