{
    "data_version": "4.0",
    "data_type": "CVE",
    "data_format": "MITRE",
    "CVE_data_meta": {
        "ID": "CVE-2019-18269",
        "ASSIGNER": "ics-cert@hq.dhs.gov",
        "STATE": "PUBLIC"
    },
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "\nOmron\u2019s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. \n\n"
            }
        ]
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-412 Unrestricted Externally Accessible Lock",
                        "cweId": "CWE-412"
                    }
                ]
            }
        ]
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "vendor_name": "Omron",
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Omron PLC CJ Series",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "=",
                                            "version_value": "all versions"
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "Omron PLC CS series",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "=",
                                            "version_value": "all versions"
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "Omron PLC NX1P2 series",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "=",
                                            "version_value": "all versions"
                                        }
                                    ]
                                }
                            }
                        ]
                    }
                }
            ]
        }
    },
    "references": {
        "reference_data": [
            {
                "url": "https://www.us-cert.gov/ics/advisories/icsa-19-346-02",
                "refsource": "MISC",
                "name": "https://www.us-cert.gov/ics/advisories/icsa-19-346-02"
            },
            {
                "url": "https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf",
                "refsource": "MISC",
                "name": "https://www.omron-cxone.com/security/2019-12-06_PLC_EN.pdf"
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.1.0-dev"
    },
    "source": {
        "discovery": "EXTERNAL"
    },
    "work_around": [
        {
            "lang": "en",
            "supportingMedia": [
                {
                    "base64": false,
                    "type": "text/html",
                    "value": "\n\n<p>Omron recommends the following mitigation measures:</p><ul><li>Filter FINS port: Protect access to Omron\u2019s PLC with a firewall and blocking unnecessary remote access to FINS port (default: 9600).</li><li>Filter IP addresses: Protect access to Omron\u2019s PLC with a firewall and filtering devices connected to the PLC by IP address.</li></ul><p>For more information provided by Omron on these vulnerabilities refer to <a target=\"_blank\" rel=\"nofollow\" href=\"https://gcc01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.omron-cxone.com%2Fsecurity%2F2019-12-06_PLC_EN.pdf&amp;data=02%7C01%7Ckent.norris%40inl.gov%7C20bf150382654ea6bed508d77a33e9d1%7C4cf464b7869a42368da2a98566485554%7C0%7C1%7C637112235716101466&amp;sdata=HF291pOMe65LwSvq4DynQqT%2FX7Sw%2BT92JGwRsXmC7WU%3D&amp;reserved=0\">Vulnerabilities in Omron CS and CJ series CPU PLCs</a>.</p>\n\n<br>"
                }
            ],
            "value": "\nOmron recommends the following mitigation measures:\n\n  *  Filter FINS port: Protect access to Omron\u2019s PLC with a firewall and blocking unnecessary remote access to FINS port (default: 9600).\n  *  Filter IP addresses: Protect access to Omron\u2019s PLC with a firewall and filtering devices connected to the PLC by IP address.\n\n\nFor more information provided by Omron on these vulnerabilities refer to  Vulnerabilities in Omron CS and CJ series CPU PLCs https://gcc01.safelinks.protection.outlook.com/ .\n\n\n\n\n"
        }
    ],
    "credits": [
        {
            "lang": "en",
            "value": "Jipeng You (XDU) and n0b0dy reported these vulnerabilities to CISA."
        }
    ]
}