CVE-2022-21137 - Omron CX-One

Back Back to CVE browser

HIGH

Omron CX-One

Published Jan 14, 2022

7.8

HIGH

CVSS 3.1

EPSS 9.27%

Description

Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code.

Affected products

Vendor Omron Product CX-One Default
n/a
- Version
  All
  Status
  affected
  Constraints
  <=4.60

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Omron

CX-One

n/a

Version	Status	Constraints
All	affected	<=4.60

Remediation

Vendor solution

Omron has released an updated version of CX-One to address the reported vulnerability. The following release is available through the CX-One auto-update service: CX-Server: Version 5.0.29.2

Weaknesses (2)

CWE-121

CWE-787

Out-of-bounds Write

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26384
Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-006-01
x_refsource_MISCThird Party AdvisoryUS Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-373/
x_refsource_MISCThird Party AdvisoryVDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-374/
x_refsource_MISCThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26384		Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-006-01		x_refsource_MISCThird Party AdvisoryUS Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-22-373/		x_refsource_MISCThird Party AdvisoryVDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-374/		x_refsource_MISCThird Party AdvisoryVDB Entry