CVE-2019-18259 - OpenCVE

In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Omron	Plc Cs Firmware Plc Cj Firmware

Configuration 1 [-]

OR	cpe:2.3:o:omron:plc_cj_firmware::::::::
	cpe:2.3:o:omron:plc_cs_firmware::::::::

References

Link	Resource
https://www.us-cert.gov/ics/advisories/icsa-19-346-02	Third Party Advisory US Government Resource

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: icscert

Published: 2019-12-16T19:19:04

Updated: 2019-12-16T19:19:04

Reserved: 2019-10-22T00:00:00

Link: CVE-2019-18259

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-12-16T20:15:15.633

Modified: 2019-12-27T15:28:15.537

Link: CVE-2019-18259

JSON object: View

Redhat Information

No data.

CWE

CWE-290

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:omron:plc_cj_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AF2C347-B4A7-4505-98A4-AFDCB1FCD386", "vulnerable": true}, {"criteria": "cpe:2.3:o:omron:plc_cs_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF9CD76C-F6E9-4E01-A039-4049B706DD92", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands."}, {"lang": "es", "value": "En el Omron PLC CJ series, todas las versiones y Omron PLC CS series, todas las versiones, un atacante podr\u00eda falsificar mensajes arbitrarios o ejecutar comandos."}], "id": "CVE-2019-18259", "lastModified": "2019-12-27T15:28:15.537", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-16T20:15:15.633", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.us-cert.gov/ics/advisories/icsa-19-346-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-290"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}