Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port…

Description

Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.

Scores

EPSS (exploitation in 30 days)

0.87% · top 41% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• Denial-of-service (DoS)
• CWE-1284 Improper Validation of Specified Quantity in Input (opens in a new tab)All about CWE-1284 and its CVEs

Affected products

• OMRON Corporation · CJ2M CPU Unit

  • affected CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier

• OMRON Corporation · CJ2H CPU Unit

  • affected CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier

• OMRON Corporation · CS/CJ Series EtherNet/IP Unit

  • affected CS1W-EIP21 V3.04 and earlier

• OMRON Corporation · CS/CJ Series EtherNet/IP Unit

  • affected CJ1W-EIP21 V3.04 and earlier

References (2)

• https://www.ia.omron.com/product/vulnerability/OMSR-2023-006_en.pdf (opens in a new tab)x_transferred
• https://jvn.jp/en/vu/JVNVU92193064/ (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-38744](https://trackcve.app/badge/CVE-2023-38744.svg)](https://trackcve.app/cve/CVE-2023-38744)

Record last updated 17 Oct 2024, 15:17 UTC.