CVE-2022-45794

Executive Summary

CVE-2022-45794 is a critical vulnerability affecting Omron CJ-series and CS-series Programmable Logic Controllers (PLCs) across all versions. The flaw allows an unauthenticated attacker with network access to read and write arbitrary files on the PLC’s internal memory and memory card using a proprietary network protocol. With a CVSS score of 8.6, this vulnerability poses a severe risk to industrial control systems (ICS) and operational technology (OT) environments, potentially enabling remote code execution, configuration tampering, and persistent compromise of critical infrastructure. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch, leaving all affected devices in a vulnerable state.

Supply Chain & Package Security

This vulnerability is not related to software supply chain packages (NPM, PyPI, Go, Ruby). It is a hardware/firmware-level issue in Omron PLCs, which are typically deployed in industrial automation and manufacturing environments. Organizations should assess their OT asset inventory for affected devices and implement network segmentation and access controls as interim mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The combination of network-based, unauthenticated access with full read/write capabilities on the PLC’s memory and memory card makes this vulnerability highly dangerous for OT environments. An attacker could exfiltrate sensitive control logic, modify program code, or cause denial of service by corrupting critical files.

Deep Dive & Mechanics

The vulnerability resides in the proprietary network protocol used by Omron CJ-series and CS-series PLCs for communication and file management. The protocol lacks proper authentication and authorization checks, allowing any network entity to send crafted packets to the PLC’s listening service (typically on TCP port 9600). The PLC processes these packets without verifying the sender’s identity, enabling file read and write operations on both the internal memory (e.g., program files, configuration data) and the external memory card (e.g., backup files, logs).

Attack Flow:

1. The attacker discovers an Omron PLC on the network (e.g., via Shodan or internal scanning).
2. The attacker sends a specially crafted network packet to the PLC’s protocol handler.
3. The PLC interprets the packet as a legitimate file operation request and executes it.
4. The attacker can read sensitive files (e.g., ladder logic, passwords) or write malicious files (e.g., modified program code, persistent backdoors).

Root Cause: Missing authentication (CWE-306) in the protocol implementation. The PLC does not require any credentials or session tokens before allowing file system access.

Vulnerable vs. Patched Code

Since no patch is available, there is no patched code to compare. The vulnerable code is the proprietary firmware of Omron CJ-series and CS-series PLCs (all versions). The following is a conceptual representation of the vulnerable protocol handler logic:

Vulnerable (Conceptual):

def handle_file_request(packet):
    # No authentication check
    operation = packet.operation
    filename = packet.filename
    data = packet.data
    if operation == "READ":
        return read_file(filename)
    elif operation == "WRITE":
        return write_file(filename, data)

Patched (Conceptual):

def handle_file_request(packet, session):
    if not session.authenticated:
        return "ERROR: Authentication required"
    operation = packet.operation
    filename = packet.filename
    data = packet.data
    if operation == "READ":
        return read_file(filename)
    elif operation == "WRITE":
        return write_file(filename, data)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the target PLC (TCP port 9600 open).
• Knowledge of the proprietary protocol (can be reverse-engineered from Omron documentation or packet captures).

Exploitation Steps:

1. Scan for vulnerable PLCs:

   nmap -p 9600 --open -sV <target_network>
   

2. Craft a read request (example using Python with raw sockets):

   import socket
   # Hypothetical packet structure (actual protocol may differ)
   packet = b"\x00\x01\x00\x00\x00\x0c" + b"READ" + b"\x00" + b"program.lad"
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect(("192.168.1.100", 9600))
   sock.send(packet)
   response = sock.recv(4096)
   print(response)
   sock.close()
   

3. Write a malicious file (e.g., overwrite a configuration file):

   packet = b"\x00\x01\x00\x00\x00\x0c" + b"WRITE" + b"\x00" + b"config.dat" + b"\x00" + b"malicious_data"
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect(("192.168.1.100", 9600))
   sock.send(packet)
   sock.close()
   

Note: No public exploit code exists; the above is a conceptual example based on the vulnerability description.

Blue Team

Detection & Response:

• Monitor network traffic to/from PLCs on TCP port 9600 for unusual packet sizes or patterns.
• Implement network segmentation to isolate PLCs from untrusted networks.
• Deploy an OT-specific IDS/IPS (e.g., Nozomi, Dragos) with custom rules for Omron protocol anomalies.
• Enable logging on PLCs (if supported) and centralize logs for analysis.

Honeypot Setup:

• Deploy a honeypot mimicking an Omron PLC on port 9600 to capture attacker behavior.
• Use tools like Conpot or custom Python scripts to simulate the protocol.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual traffic to/from TCP port 9600 on Omron PLCs.
  • Packets with non-standard payload sizes or unexpected file operation commands.
  • Connections from IP addresses outside the expected OT network range.

• Host IOCs:

  • Modified or new files on the PLC’s internal memory or memory card (e.g., altered ladder logic, unexpected configuration files).
  • Unexplained changes in PLC behavior (e.g., unexpected outputs, altered control logic).

• File IOCs:

  • Suspicious file names or paths written to the memory card (e.g., backdoor.lad, malicious.dat).

Detection Engineering

YARA Rule

rule CVE_2022_45794_Omron_PLC_FileAccess {
    meta:
        description = "Detects network packets targeting Omron PLC file operations on port 9600"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-45794"
    strings:
        $read_cmd = "READ" ascii wide nocase
        $write_cmd = "WRITE" ascii wide nocase
        $delete_cmd = "DELETE" ascii wide nocase
    condition:
        // Check for file operation commands in network traffic
        any of ($read_cmd, $write_cmd, $delete_cmd) and
        // Additional heuristic: packet length > 20 bytes (typical for file ops)
        filesize > 20
}

Sigma Rule

title: CVE-2022-45794 Omron PLC Unauthenticated File Access
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects network connections to Omron PLCs on TCP port 9600 with file operation commands
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-45794
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        DestinationPort: 9600
        Protocol: tcp
    condition: selection
falsepositives:
    - Legitimate PLC programming software (e.g., CX-Programmer)
level: high

Suricata Rule

alert tcp any any -> any 9600 (msg:"CVE-2022-45794 Omron PLC Unauthenticated File Access Attempt"; flow:to_server; content:"|00 01 00 00 00 0c|"; depth:6; content:"READ"; distance:0; within:4; sid:1000001; rev:1;)
alert tcp any any -> any 9600 (msg:"CVE-2022-45794 Omron PLC Unauthenticated File Write Attempt"; flow:to_server; content:"|00 01 00 00 00 0c|"; depth:6; content:"WRITE"; distance:0; within:5; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Isolate Omron PLCs on a dedicated OT network with strict firewall rules. Block TCP port 9600 from all untrusted networks.
2. Access Control: Implement IP whitelisting to allow only trusted engineering workstations to communicate with PLCs.
3. Monitoring: Deploy network monitoring tools to detect anomalous traffic on port 9600.

Long-Term Actions:

1. Vendor Contact: Reach out to Omron for an official patch or firmware update. Monitor Omron’s security advisories.
2. Device Replacement: If no patch is forthcoming, consider replacing affected PLCs with newer models that have proper authentication.
3. Virtual Patching: Use an OT firewall or IPS to create virtual patches that block known malicious patterns.

Workarounds:

• Disable the file access protocol if not required (consult Omron documentation).
• Use a VPN or encrypted tunnel for remote access to PLCs.

Valters IT