CVE-2019-18261

In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

CVSS v3 9.8 CRITICAL
CVSS v2.0 5.0 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://www.us-cert.gov/ics/advisories/icsa-19-346-03	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:omron:plc_cj_firmware::::::::
	cpe:2.3:o:omron:plc_cs_firmware::::::::
	cpe:2.3:o:omron:plc_nj_firmware::::::::

History

No history.

Information

Published : 2019-12-16 20:15

Updated : 2019-12-27 15:21

NVD link : CVE-2019-18261

Mitre link : CVE-2019-18261

CVE.ORG link : CVE-2019-18261

JSON object : View

Products Affected

omron

plc_cs_firmware
plc_nj_firmware
plc_cj_firmware

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2019-18261", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2019-12-16T20:15:15.697", "references": [{"url": "https://www.us-cert.gov/ics/advisories/icsa-19-346-03", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-307"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks."}, {"lang": "es", "value": "En el Omron PLC CS series, todas las versiones, el Omron PLC CJ series, todas las versiones y el Omron PLC NJ series, todas las versiones, el software no implementa medidas suficientes para impedir m\u00faltiples intentos de autenticaci\u00f3n fallidos dentro un per\u00edodo de tiempo corto, haci\u00e9ndola m\u00e1s susceptible a los ataques de fuerza bruta."}], "lastModified": "2019-12-27T15:21:17.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:omron:plc_cj_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AF2C347-B4A7-4505-98A4-AFDCB1FCD386"}, {"criteria": "cpe:2.3:o:omron:plc_cs_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF9CD76C-F6E9-4E01-A039-4049B706DD92"}, {"criteria": "cpe:2.3:o:omron:plc_nj_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DA0D87D7-A7AF-45DE-90EE-67103BA00A6B"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}