{"id":"CVE-2023-27396","url":"https://www.cyber-defence.io/tools/cve/CVE-2023-27396","generatedAt":"2026-10-25T17:23:40.952Z","title":"When arbitrary FINS messages are injected, any commands may be executed on, or the system information may be retrieved from, the affected device.","description":"FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues -- (1)Plaintext communication, and (2)No authentication required. When FINS messages are intercepted, the contents may be retrieved. When arbitrary FINS messages are injected, any commands may be executed on, or the system information may be retrieved from, the affected device. Affected products and versions are as follows: SYSMAC CS-series CPU Units, all versions, SYSMAC CJ-series CPU Units, all versions, SYSMAC CP-series CPU Units, all versions, SYSMAC NJ-series CPU Units, all versions, SYSMAC NX1P-series CPU Units, all versions, SYSMAC NX102-series CPU Units, all versions, and SYSMAC NX7 Database Connection CPU Units (Ver.1.16 or later)","published":"2023-06-19T05:15:09.000Z","lastModified":"2026-06-17T05:44:57.000Z","status":"Modified","sourceIdentifier":"vultures@jpcert.or.jp","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-306"],"affected":["omron/cs1w-eip21 firmware","omron/cs1w-spu01-v2 firmware","omron/cs1w-spu02-v2 firmware","omron/cs1w-etn21 firmware","omron/cs1w-clk firmware","omron/cs1w-fln22 firmware","omron/cs1w-drm21-v1 firmware","omron/cs1w-nc271 firmware","omron/cs1w-nc471 firmware","omron/cs1w-ncf71 firmware","omron/cj2m-cpu35 firmware","omron/cj2m-cpu34 firmware","omron/cj2m-cpu33 firmware","omron/cj2m-cpu32 firmware","omron/cj2m-cpu31 firmware","omron/cj2m-cpu15 firmware","omron/cj2m-cpu14 firmware","omron/cj2m-cpu13 firmware","omron/cj2m-cpu12 firmware","omron/cj2m-cpu11 firmware","omron/cp1w-cif01 firmware","omron/cp1w-cif11 firmware","omron/cp1w-cif12-v1 firmware","omron/cj2m-md211 firmware","omron/cj2m-md212 firmware","omron/cj2h-cpu68-eip firmware","omron/cj2h-cpu67-eip firmware","omron/cj2h-cpu66-eip firmware","omron/cj2h-cpu65-eip firmware","omron/cj2h-cpu64-eip firmware","omron/cj2h-cpu68 firmware","omron/cj2h-cpu67 firmware","omron/cj2h-cpu66 firmware","omron/cj2h-cpu65 firmware","omron/cj2h-cpu64 firmware","omron/cp2e-n14dr-a firmware","omron/cp2e-n14dt-a firmware","omron/cp2e-n14dr-d firmware","omron/cp2e-n14dt-d firmware","omron/cp2e-n14dt1-d firmware","omron/cp2e-n20dr-a firmware","omron/cp2e-n20dt-a firmware","omron/cp2e-n20dr-d firmware","omron/cp2e-n20dt-d firmware","omron/cp2e-n20dt1-d firmware","omron/cp2e-n30dr-a firmware","omron/cp2e-n30dt-a firmware","omron/cp2e-n30dr-d firmware","omron/cp2e-n30dt-d firmware","omron/cp2e-n30dt1-d firmware","omron/cp2e-n40dr-a firmware","omron/cp2e-n40dt-a firmware","omron/cp2e-n40dr-d firmware","omron/cp2e-n40dt-d firmware","omron/cp2e-n40dt1-d firmware","omron/cp2e-n60dr-a firmware","omron/cp2e-n60dt-a firmware","omron/cp2e-n60dr-d firmware","omron/cp2e-n60dt-d firmware","omron/cp2e-n60dt1-d firmware"],"epss":{"score":0.01374,"percentile":0.71828,"date":"2026-10-24","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://jvn.jp/en/ta/JVNTA91513661/","tags":["Third Party Advisory"],"source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/ta/JVNTA91513661/","tags":["Third Party Advisory"],"source":"vultures@jpcert.or.jp"},{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02","tags":["Not Applicable","Third Party Advisory","US Government Resource"],"source":"vultures@jpcert.or.jp"},{"url":"https://www.fa.omron.co.jp/product/vulnerability/OMSR-2023-003_ja.pdf","tags":["Vendor Advisory"],"source":"vultures@jpcert.or.jp"},{"url":"https://www.ia.omron.com/product/vulnerability/OMSR-2023-003_en.pdf","tags":["Vendor Advisory"],"source":"vultures@jpcert.or.jp"},{"url":"https://www.us-cert.gov/ics/advisories/icsa-19-346-02","tags":["Not Applicable","Third Party Advisory","US Government Resource"],"source":"vultures@jpcert.or.jp"},{"url":"https://www.us-cert.gov/ics/advisories/icsa-20-063-03","tags":["Not Applicable","Third Party Advisory","US Government Resource"],"source":"vultures@jpcert.or.jp"},{"url":"https://jvn.jp/en/ta/JVNTA91513661/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://jvn.jp/ta/JVNTA91513661/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-02","tags":["Not Applicable","Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.fa.omron.co.jp/product/vulnerability/OMSR-2023-003_ja.pdf","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.ia.omron.com/product/vulnerability/OMSR-2023-003_en.pdf","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.us-cert.gov/ics/advisories/icsa-19-346-02","tags":["Not Applicable","Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.us-cert.gov/ics/advisories/icsa-20-063-03","tags":["Not Applicable","Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-27396","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}