CVE-2023-273969.8CriticalCWE-306

CVE-2023-27396: OMRON Corporation Multiple OMRON products which implement FINS protocol vulnerability

OMRON Corporation · Multiple OMRON products which implement FINS protocol

Affected: OMRON Corporation Multiple OMRON products which implement FINS protocol · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.4%probability of exploitation in the next 30 days

72nd percentile

050100

Higher than 72% of scored CVEs

9.8CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues -- (1)Plaintext communication, and (2)No authentication required. When FINS messages are intercepted, the contents may be retrieved. When arbitrary FINS messages are injected, any commands may be executed on, or the system information may be retrieved from, the affected device. Affected products and versions are as follows: SYSMAC CS-series CPU Units, all versions, SYSMAC CJ-series CPU Units, all versions, SYSMAC CP-series CPU Units, all versions, SYSMAC NJ-series CPU Units, all versions, SYSMAC NX1P-series CPU Units, all versions, SYSMAC NX102-series CPU Units, all versions, and SYSMAC NX7 Database Connection CPU Units (Ver.1.16 or later)

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

OMRON Corporation · Multiple OMRON products which implement FINS protocolSYSMAC CS-series CPU Units all versions, SYSMAC CJ-series C…

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Missing Authentication · Authentication
Vendor: OMRON Corporation
Published: June 2023
Band: Possible (1 to 10%), June 2023

CoverageNo articles yet

No CyberSIXT article names CVE-2023-27396 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.