Skip to content
Fencer Vulns
critical 9.8

CVE-2022-31206 json

The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentic…

published 2022-07-26 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-52790

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU code to native machine code for execution by the PLC's runtime). The resulting machine code is executed by a runtime, typically controlled by a real-time operating system. The logic that is downloaded to the PLC does not seem to be cryptographically authenticated, allowing an attacker to manipulate transmitted object code to the PLC and execute arbitrary machine code on the processor of the PLC's CPU module in the context of the runtime. In the case of at least the NJ series, an RTOS and hardware combination is used that would potentially allow for memory protection and privilege separation and thus limit the impact of code execution. However, it was not confirmed whether these sufficiently segment the runtime from the rest of the RTOS.

Patch / fix

  • omron nx701-1600_firmware 1.29
  • omron nx701-1620_firmware 1.29
  • omron nx701-1700_firmware 1.29
  • omron nx701-1720_firmware 1.29
  • omron nx701-z600_firmware 1.29
  • omron nx701-z700_firmware 1.29
  • omron nj101-1000_firmware 1.49
  • omron nj101-1020_firmware 1.49
  • omron nj101-9000_firmware 1.49
  • omron nj101-9020_firmware 1.49
  • omron nj301-1100_firmware 1.49
  • omron nj301-1200_firmware 1.49
  • omron nj501-1300_firmware 1.49
  • omron nj501-1320_firmware 1.49
  • omron nj501-1340_firmware 1.49
  • omron nj501-1400_firmware 1.49
  • omron nj501-1420_firmware 1.49
  • omron nj501-1500_firmware 1.49
  • omron nj501-1520_firmware 1.49
  • omron nj501-4300_firmware 1.49

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-179-02 updated cvss 4.4

Omron SYSMAC CS/CJ/CP Series and NJ/NX Series

  • Omron CP1W-CIF41 Omron SYSMAC CJ2H < 1.5 Omron SYSMAC CJ2M < 2.1 Omron SYSMAC CP1E/CP1H < 1.30 Omron SYSMAC CP1L < 1.10 Omron SYSMAC CS1H/CJ1G < 4.1
    +2 more products
    Omron SYSMAC CX-Programmer < 9.6 Omron SYSMAC NJ/NX Series < 1.49 (1.29 for NX7)
    affected: mitigation “For CVE-2022-31206: Omron intends to publish an update for SYSMAC NJ/NX in July 2022.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.