CVE-2022-31206

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-26 · updated 2026-06-17
Weakness: CWE-347

Description

The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.

Affected products

Omron Nj101-1000 Firmware: before 1.49 — fixed in 1.49
Omron Nj101-1020 Firmware: before 1.49 — fixed in 1.49
Omron Nj101-9000 Firmware: before 1.49 — fixed in 1.49
Omron Nj101-9020 Firmware: before 1.49 — fixed in 1.49
Omron Nj301-1100 Firmware: before 1.49 — fixed in 1.49
Omron Nj301-1200 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-1300 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-1320 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-1340 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-1400 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-1420 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-1500 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-1520 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-4300 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-4320 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-4400 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-4500 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-5300-1 Firmware: before 1.49 — fixed in 1.49
Omron Nj501-5300 Firmware: before 1.49 — fixed in 1.49
Omron Nx701-1600 Firmware: before 1.29 — fixed in 1.29
Omron Nx701-1620 Firmware: before 1.29 — fixed in 1.29
Omron Nx701-1700 Firmware: before 1.29 — fixed in 1.29
Omron Nx701-1720 Firmware: before 1.29 — fixed in 1.29
Omron Nx701-Z600 Firmware: before 1.29 — fixed in 1.29
Omron Nx701-Z700 Firmware: before 1.29 — fixed in 1.29

How to fix

Upgrade to a fixed version: Omron Nj101-1000 Firmware 1.49; Omron Nj101-1020 Firmware 1.49; Omron Nj101-9000 Firmware 1.49; Omron Nj101-9020 Firmware 1.49; Omron Nj301-1100 Firmware 1.49; Omron Nj301-1200 Firmware 1.49; Omron Nj501-1300 Firmware 1.49; Omron Nj501-1320 Firmware 1.49; Omron Nj501-1340 Firmware 1.49; Omron Nj501-1400 Firmware 1.49; Omron Nj501-1420 Firmware 1.49; Omron Nj501-1500 Firmware 1.49. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-31206 or the next vulnerability affects your stack