Skip to content
Fencer Vulns
high 7.5

CVE-2022-31204 json

Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords.

published 2022-07-26 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-52788

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as project/logic uploads and downloads). This password is set using the OMRON FINS command Program Area Protect and unset using the command Program Area Protect Clear, both of which are transmitted in cleartext.

Patch / fix

  • omron cx-programmer 9.6
  • omron sysmac_cs1_firmware 4.1
  • omron sysmac_cj2m_firmware 2.1
  • omron sysmac_cj2h_firmware 1.5
  • omron sysmac_cp1e_firmware 1.30
  • omron sysmac_cp1h_firmware 1.30
  • omron sysmac_cp1l_firmware 1.10

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-179-02 updated cvss 6.5

Omron SYSMAC CS/CJ/CP Series and NJ/NX Series

  • Omron CP1W-CIF41 Omron SYSMAC CJ2H < 1.5 Omron SYSMAC CJ2M < 2.1 Omron SYSMAC CP1E/CP1H < 1.30 Omron SYSMAC CP1L < 1.10 Omron SYSMAC CS1H/CJ1G < 4.1
    +2 more products
    Omron SYSMAC CX-Programmer < 9.6 Omron SYSMAC NJ/NX Series < 1.49 (1.29 for NX7)
    affected: mitigation “For CVE-2022-31204: Omron recommends users implement an extended password protection function in the following product versions: CS1: v.4.1 or later”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

Weakness
  • CWE-319 Cleartext Transmission of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.