Omron SYSMAC CS/CJ/CP Series and NJ/NX Series Improper Verification of Cryptographic Signature (CVE-2022-31206)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501150);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2022-31206");

  script_name(english:"Omron SYSMAC CS/CJ/CP Series and NJ/NX Series Improper Verification of Cryptographic Signature (CVE-2022-31206)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX
series, and PMAC series) through 2022-005-18 lack cryptographic
authentication. These PLCs are programmed using the SYMAC Studio
engineering software (which compiles IEC 61131-3 conformant POU code
to native machine code for execution by the PLC's runtime). The
resulting machine code is executed by a runtime, typically controlled
by a real-time operating system. The logic that is downloaded to the
PLC does not seem to be cryptographically authenticated, allowing an
attacker to manipulate transmitted object code to the PLC and execute
arbitrary machine code on the processor of the PLC's CPU module in the
context of the runtime. In the case of at least the NJ series, an RTOS
and hardware combination is used that would potentially allow for
memory protection and privilege separation and thus limit the impact
of code execution. However, it was not confirmed whether these
sufficiently segment the runtime from the rest of the RTOS.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.forescout.com/blog/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

 For CVE-2022-31204: Omron recommends users implement an extended password protection function in the following product
versions:

- CS1, v.4.1 or later 
- CJ2M, v2.1 or later 
- CJ2H, v1.5 or later
- CP1E/CP1H , v1.30 or later
- CP1L, v1.10 or later 
- CX-Programmer, v9.6 or higher

For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.

For CVE-2022-31207: Omron recommends users of SYSMAC CS/CJ/CP Series to use the PLC protection password and enable
protection against unauthorized write access to address. Also, there are hardware DIP switches on the PLC which can
prevent unauthorized PLC program changes regardless of password.

For CVE-2022-31205: Omron recommends using different passwords between the CP1W-CIF41 Ethernet Option Board and CP1 PLC
itself. The Web UI password will not grant access to the PLC.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-31206");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(347);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/07/26");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/07/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/05/22");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj101-1000_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj101-1020_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj101-9000_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj101-9020_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj301-1100_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj301-1200_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-1300_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-1320_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-1340_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-1400_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-1420_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-1500_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-1520_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-4300_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-4320_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-4400_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-4500_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-5300-1_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nj501-5300_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nx701-1600_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nx701-1620_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nx701-1700_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nx701-1720_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nx701-z600_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:omron:nx701-z700_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Omron");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Omron');

var asset = tenable_ot::assets::get(vendor:'Omron');

var vuln_cpes = {
    "cpe:/o:omron:nx701-1600_firmware" :
        {"versionEndExcluding" : "1.29", "family" : "NX7"},
    "cpe:/o:omron:nx701-1620_firmware" :
        {"versionEndExcluding" : "1.29", "family" : "NX7"},
    "cpe:/o:omron:nx701-1700_firmware" :
        {"versionEndExcluding" : "1.29", "family" : "NX7"},
    "cpe:/o:omron:nx701-1720_firmware" :
        {"versionEndExcluding" : "1.29", "family" : "NX7"},
    "cpe:/o:omron:nx701-z600_firmware" :
        {"versionEndExcluding" : "1.29", "family" : "NX7"},
    "cpe:/o:omron:nx701-z700_firmware" :
        {"versionEndExcluding" : "1.29", "family" : "NX7"},
    "cpe:/o:omron:nj101-1000_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ101"},
    "cpe:/o:omron:nj101-1020_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ101"},
    "cpe:/o:omron:nj101-9000_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ101"},
    "cpe:/o:omron:nj101-9020_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ101"},
    "cpe:/o:omron:nj301-1100_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ201"},
    "cpe:/o:omron:nj301-1200_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ201"},
    "cpe:/o:omron:nj501-1300_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-1320_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-1340_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-1400_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-1420_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-1500_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-1520_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-4300_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-4320_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-4400_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-4500_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-5300_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"},
    "cpe:/o:omron:nj501-5300-1_firmware" :
        {"versionEndExcluding" : "1.49", "family" : "NJ501"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);