Read the docs
TI-2023-20084 Aliases CVE-2023-38744GHSA-8262-vqgw-h22m

Denial-of-service (DoS) vulnerability due to improper validation of specified type of…

Priority MEDIUM 40CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00866 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OMRON CorporationCJ2M CPU UnitCJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier—No fix listedCNA
OMRON CorporationCJ2H CPU UnitCJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier—No fix listedCNA
OMRON CorporationCS/CJ Series EtherNet/IP UnitCS1W-EIP21 V3.04 and earlier—No fix listedCNA
OMRON CorporationCS/CJ Series EtherNet/IP UnitCJ1W-EIP21 V3.04 and earlier—No fix listedCNA
  • CJ2M CPU Unit VendorOMRON Corporation Affected CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier Fixed in — No fix listed CNA
  • CJ2H CPU Unit VendorOMRON Corporation Affected CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier Fixed in — No fix listed CNA
  • CS/CJ Series EtherNet/IP Unit VendorOMRON Corporation Affected CS1W-EIP21 V3.04 and earlier Fixed in — No fix listed CNA
  • CS/CJ Series EtherNet/IP Unit VendorOMRON Corporation Affected CJ1W-EIP21 V3.04 and earlier Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:o:omron:cj2m-cpu35_firmware:*:*:*:*:*:*:*:*up to 2.18VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2m-cpu35:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj2m-cpu34_firmware:*:*:*:*:*:*:*:*up to 2.18VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2m-cpu34:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj2m-cpu33_firmware:*:*:*:*:*:*:*:*up to 2.18VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2m-cpu33:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj2m-cpu32_firmware:*:*:*:*:*:*:*:*up to 2.18VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2m-cpu32:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj2m-cpu31_firmware:*:*:*:*:*:*:*:*up to 2.18VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2m-cpu31:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
  • cpe:2.3:o:omron:cj2m-cpu35_firmware:*:*:*:*:*:*:*:* Versions up to 2.18 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2m-cpu35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj2m-cpu34_firmware:*:*:*:*:*:*:*:* Versions up to 2.18 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2m-cpu34:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj2m-cpu33_firmware:*:*:*:*:*:*:*:* Versions up to 2.18 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2m-cpu33:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj2m-cpu32_firmware:*:*:*:*:*:*:*:* Versions up to 2.18 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2m-cpu32:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj2m-cpu31_firmware:*:*:*:*:*:*:*:* Versions up to 2.18 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2m-cpu31:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:omron:cj2h-cpu68-eip_firmware:*:*:*:*:*:*:*:*up to 3.04VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2h-cpu68-eip:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj2h-cpu67-eip_firmware:*:*:*:*:*:*:*:*up to 3.04VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2h-cpu67-eip:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj2h-cpu66-eip_firmware:*:*:*:*:*:*:*:*up to 3.04VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2h-cpu66-eip:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj2h-cpu65-eip_firmware:*:*:*:*:*:*:*:*up to 3.04VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2h-cpu65-eip:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj2h-cpu64-eip_firmware:*:*:*:*:*:*:*:*up to 3.04VulnerableOMRON Corporation
cpe:2.3:h:omron:cj2h-cpu64-eip:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cs1w-eip21_firmware:*:*:*:*:*:*:*:*up to 3.04VulnerableOMRON Corporation
cpe:2.3:h:omron:cs1w-eip21:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
cpe:2.3:o:omron:cj1w-eip21_firmware:*:*:*:*:*:*:*:*up to 3.04VulnerableOMRON Corporation
cpe:2.3:h:omron:cj1w-eip21:-:*:*:*:*:*:*:*not specified by NVDRunning onOMRON Corporation
  • cpe:2.3:o:omron:cj2h-cpu68-eip_firmware:*:*:*:*:*:*:*:* Versions up to 3.04 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2h-cpu68-eip:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj2h-cpu67-eip_firmware:*:*:*:*:*:*:*:* Versions up to 3.04 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2h-cpu67-eip:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj2h-cpu66-eip_firmware:*:*:*:*:*:*:*:* Versions up to 3.04 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2h-cpu66-eip:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj2h-cpu65-eip_firmware:*:*:*:*:*:*:*:* Versions up to 3.04 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2h-cpu65-eip:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj2h-cpu64-eip_firmware:*:*:*:*:*:*:*:* Versions up to 3.04 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj2h-cpu64-eip:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cs1w-eip21_firmware:*:*:*:*:*:*:*:* Versions up to 3.04 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cs1w-eip21:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation
  • cpe:2.3:o:omron:cj1w-eip21_firmware:*:*:*:*:*:*:*:* Versions up to 3.04 Vulnerable ·OMRON Corporation
  • cpe:2.3:h:omron:cj1w-eip21:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·OMRON Corporation

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-38744
  2. 2026-10-03 Alias added: GHSA-8262-vqgw-h22m

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences