Command Execution Vulnerability in OMRON CP1L-EL20DR-D by OMRON
CVE-2023-22357
9.8CRITICAL
What is CVE-2023-22357?
A command execution vulnerability is present in OMRON's CP1L-EL20DR-D, allowing remote, unauthenticated attackers to execute commands not specified within the FINS protocol. This flawed active debug code permits unauthorized read/write access to arbitrary areas of the device's memory. Exploiting this vulnerability could result in overwriting the device's firmware, potentially leading to a denial-of-service condition or the execution of arbitrary code, putting systems at significant risk.
Affected Version(s)
CP1L-EL20DR-D All versions
References
EPSS Score
5% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved