CVE-2022-29958

JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory address and a blob of machine code. The logic that is downloaded to the PLC is not cryptographically authenticated, allowing an attacker to execute arbitrary machine code on the PLC's CPU module in the context of the runtime. In the case of the PC10G-CPU, and likely for other CPU modules of the TOYOPUC family, a processor without MPU or MMU is used and this no memory protection or privilege-separation capabilities are available, giving an attacker full control over the CPU.

• CWE-345

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-02Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-02Third Party Advisory, US Government Resource
• https://www.forescout.com/blog/Third Party Advisory

Published

Jul 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-2995Incorrect handling of the supplementary groups in the CRI-O …7.1
• CVE-2022-29950Experian Hunter 1.16 allows remote authenticated users to mo…4.3
• CVE-2022-29951JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authenticati…9.1
• CVE-2022-29952Bently Nevada condition monitoring equipment through 2022-04…9.1
• CVE-2022-29953The Bently Nevada 3700 series of condition monitoring equipm…9.8
• CVE-2022-29957The Emerson DeltaV Distributed Control System (DCS) through …7.8
• CVE-2022-29959Emerson OpenBSI through 2022-04-29 mishandles credential sto…5.5
• CVE-2022-2996A flaw was found in the python-scciclient when making an HTT…7.4
• CVE-2022-29960Emerson OpenBSI through 2022-04-29 uses weak cryptography. I…5.5
• CVE-2022-29962The Emerson DeltaV Distributed Control System (DCS) controll…5.5
• CVE-2022-29963The Emerson DeltaV Distributed Control System (DCS) controll…5.5
• CVE-2022-29964The Emerson DeltaV Distributed Control System (DCS) controll…5.5