Omron CS/CJ Series

An attacker with network access to a SYSMAC PLC could read sensitive data from the device's file system and memory without credentials, including program logic, configuration data, and potentially security-critical information. This compromises the confidentiality of your control system and could allow an attacker to plan further attacks or extract intellectual property.

Water and electric utilities, manufacturing plants, and any organization using Omron SYSMAC CS1D, CS1G, CS1H, CJ1G, CJ2H, or CJ2M series PLCs should be concerned. These devices are commonly used to control critical processes including pump stations, motor drives, process setpoints, and safety interlocks. Any facility with networked SYSMAC PLCs is affected.

An attacker on your network sends an unauthenticated FINS protocol request to the PLC on port 9600 (or another FINS port). Because the device lacks proper authentication checks, the PLC responds with sensitive information from its file system or memory. No credentials or special configuration is required.