CVE-2022-45790
CRITICALCVSS 9.1/10EPSS 0.70%
Last modified
CVE-2022-45790 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. EPSS estimates a 0.70% chance of exploitation in the next 30 days.
Description
The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Omron | Cj1g-Cpu45p Firmware | < 4.1 |
| Omron | Cj1g-Cpu45p-Gtc Firmware | < 4.1 |
| Omron | Cj1g-Cpu44p Firmware | < 4.1 |
| Omron | Cj1g-Cpu43p Firmware | < 4.1 |
| Omron | Cj1g-Cpu42p Firmware | < 4.1 |
| Omron | Cp1e-E Firmware | < 1.3 |
| Omron | Cp1e-N Firmware | < 1.3 |
| Omron | Cj2h-Cpu68 Firmware | < 1.5 |
| Omron | Cj2h-Cpu67 Firmware | < 1.5 |
| Omron | Cj2h-Cpu66 Firmware | < 1.5 |
| Omron | Cj2h-Cpu65 Firmware | < 1.5 |
| Omron | Cj2h-Cpu64 Firmware | < 1.5 |
| Omron | Cj2h-Cpu68-Eip Firmware | < 1.5 |
| Omron | Cj2h-Cpu67-Eip Firmware | < 1.5 |
| Omron | Cj2h-Cpu66-Eip Firmware | < 1.5 |
| Omron | Cj2h-Cpu65-Eip Firmware | < 1.5 |
| Omron | Cj2h-Cpu64-Eip Firmware | < 1.5 |
| Omron | Cj2m-Cpu35 Firmware | < 2.1 |
| Omron | Cj2m-Cpu34 Firmware | < 2.1 |
| Omron | Cj2m-Cpu33 Firmware | < 2.1 |
| Omron | Cj2m-Cpu32 Firmware | < 2.1 |
| Omron | Cj2m-Cpu31 Firmware | < 2.1 |
| Omron | Cj2m-Cpu15 Firmware | < 2.1 |
| Omron | Cj2m-Cpu14 Firmware | < 2.1 |
| Omron | Cj2m-Cpu13 Firmware | < 2.1 |
| Omron | Cj2m-Cpu12 Firmware | < 2.1 |
| Omron | Cj2m-Cpu11 Firmware | < 2.1 |
| Omron | Cj2m-Md211 Firmware | < 2.1 |
| Omron | Cj2m-Md212 Firmware | < 2.1 |
| Omron | Cs1d-Cpu67s Firmware | < 2.1 |
| Omron | Cs1d-Cpu65s Firmware | < 2.1 |
| Omron | Cs1d-Cpu44s Firmware | < 2.1 |
| Omron | Cs1d-Cpu42s Firmware | < 2.1 |
| Omron | Cs1d-Cpu65p Firmware | < 1.4 |
| Omron | Cs1d-Cpu67p Firmware | < 1.4 |
| Omron | Cs1d-Cpu67h Firmware | < 1.4 |
| Omron | Cs1d-Cpu65h Firmware | < 1.4 |
| Omron | Cs1h-Cpu67h Firmware | < 4.1 |
| Omron | Cs1h-Cpu66h Firmware | < 4.1 |
| Omron | Cs1h-Cpu65h Firmware | < 4.1 |
| Omron | Cs1h-Cpu64h Firmware | < 4.1 |
| Omron | Cs1h-Cpu63h Firmware | < 4.1 |
| Omron | Cs1g-Cpu45h Firmware | < 4.1 |
| Omron | Cs1g-Cpu44h Firmware | < 4.1 |
| Omron | Cs1g-Cpu43h Firmware | < 4.1 |
| Omron | Cs1g-Cpu42h Firmware | < 4.1 |
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-05Third Party Advisory, US Government Resource
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-05Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-45790?
The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic.
How severe is CVE-2022-45790?
CVE-2022-45790 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 0.70% probability of exploitation in the next 30 days.
How do I fix CVE-2022-45790?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-45783An issue was discovered in dotCMS core 4.x through 22.10.2. …6.5
- CVE-2022-45786There are issues with the AGE drivers for Golang and Python …8.1
- CVE-2022-45787Unproper laxist permissions on the temporary files used by M…5.5
- CVE-2022-45788A CWE-754: Improper Check for Unusual or Exceptional Conditi…9.8
- CVE-2022-45789A CWE-294: Authentication Bypass by Capture-replay vulnerabi…9.8
- CVE-2022-4579Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-45791Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2022-45792Project files may contain malicious contents which the softw…7.8
- CVE-2022-45793Sysmac Studio installs executables in a directory with poor …7.8
- CVE-2022-45794An attacker with network access to the affected PLC (CJ-seri…7.5
- CVE-2022-45795Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2022-45796Command injection vulnerability in nw_interface.html in SHAR…7.2
Are you affected by CVE-2022-45790?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST