Omron CX-One CX-Protocol
Monitor6.6ICS-CERT ICSA-19-010-02Jan 10, 2019
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
CX-Protocol versions 2.0 and earlier contain a code execution vulnerability (CWE-843) that allows an attacker with local access to execute code under the privileges of the application through user interaction. Successful exploitation could compromise the engineering workstation and potentially affect connected control systems. The vulnerability is not remotely exploitable. Omron has released CX-Protocol version 2.01 to address this issue, available through the CX-One auto-update service.
What this means
What could happen
An attacker with local access to a machine running CX-Protocol could execute arbitrary code with the privileges of the application, potentially compromising the engineering workstation and any systems it communicates with.
Who's at risk
Omron CX-Protocol users who rely on engineering workstations to program or configure Omron PLCs and automation controllers should care about this vulnerability. It affects anyone using CX-One software on Windows workstations in water treatment, wastewater, power generation, or other critical infrastructure environments.
How it could be exploited
An attacker with local access to a computer running CX-Protocol (version 2.0 or earlier) can exploit a code execution vulnerability through user interaction, such as tricking an engineer into opening a malicious file or accepting a suspicious operation. The attacker's code would then run with the same privileges as the CX-Protocol application.
Prerequisites
- Local access to the machine running CX-Protocol
- CX-Protocol version 2.0 or earlier installed
- User interaction required (e.g., opening a file or confirming an action)
Local access required (not remotely exploitable)User interaction requiredCode execution capabilityLow EPSS score (0.3%)
Exploitability
Low exploit probability (EPSS 0.3%)
Affected products (1)
ProductAffected VersionsFix Status
CX-Protocol:≤ 2.02.01
Remediation & Mitigation
0/4
Do now
0/2HARDENINGRestrict local access to engineering workstations running CX-Protocol to authorized personnel only
HARDENINGTrain operators and engineers to avoid opening files or accepting operations from untrusted sources on engineering workstations
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate CX-Protocol to version 2.01 or later using the CX-One auto-update service
Long-term hardening
0/1HARDENINGIsolate the CX-One/CX-Protocol engineering network from the business network using firewalls
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/2c826f75-2383-41df-9a60-453f25e0370e