9.1

CVE-2022-29951

JTEKT TOYOPUC PLCs through 2022-04-29 mishandle authentication. They utilize the CMPLink/TCP protocol (configurable on ports 1024-65534 on either TCP or UDP) for a wide variety of engineering purposes such as starting and stopping the PLC, downloading and uploading projects, and changing configuration settings. This protocol does not have any authentication features, allowing any attacker capable of communicating with the port in question to invoke (a subset of) desired functionality.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jtekt ≫ Pc10g-cpu Tcc-6353 Firmware Version -
   Jtekt ≫ Pc10g-cpu Tcc-6353 Version -
Jtekt ≫ Pc10ge Tcc-6464 Firmware Version -
   Jtekt ≫ Pc10ge Tcc-6464 Version -
Jtekt ≫ Pc10p Tcc-6372 Firmware Version -
   Jtekt ≫ Pc10p Tcc-6372 Version -
Jtekt ≫ Pc10p-dp Tcc-6726 Firmware Version -
   Jtekt ≫ Pc10p-dp Tcc-6726 Version -
Jtekt ≫ Pc10b-p Tcc-6373 Firmware Version -
   Jtekt ≫ Pc10b-p Tcc-6373 Version -
Jtekt ≫ Pc10b Tcc-1021 Firmware Version -
   Jtekt ≫ Pc10b Tcc-1021 Version -
Jtekt ≫ Pc10e Tcc-4737 Firmware Version -
   Jtekt ≫ Pc10e Tcc-4737 Version -
Jtekt ≫ Pc10el Tcc-4747 Firmware Version -
   Jtekt ≫ Pc10el Tcc-4747 Version -
Jtekt ≫ Plus Cpu Tcc-6740 Firmware Version -
   Jtekt ≫ Plus Cpu Tcc-6740 Version -
Jtekt ≫ Pc3jx Tcc-6901 Firmware Version -
   Jtekt ≫ Pc3jx Tcc-6901 Version -
Jtekt ≫ Pc3jx-d Tcc-6902 Firmware Version -
   Jtekt ≫ Pc3jx-d Tcc-6902 Version -
Jtekt ≫ Pc10pe Tcc-1101 Firmware Version -
   Jtekt ≫ Pc10pe Tcc-1101 Version -
Jtekt ≫ Pcdl Tkc-6688 Firmware Version -
   Jtekt ≫ Pcdl Tkc-6688 Version -
Jtekt ≫ Nano 10gx Tuc-1157 Firmware Version -
   Jtekt ≫ Nano 10gx Tuc-1157 Version -
Jtekt ≫ Nano Cpu Tuc-6941 Firmware Version -
   Jtekt ≫ Nano Cpu Tuc-6941 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.21% 0.655
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA-ADP 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-02
Third Party Advisory
US Government Resource
Mitigation
https://www.forescout.com/blog/
Third Party Advisory