CVE-2024-12298

Summary

We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer.

Affected Software

VendorProductVersion RangeStatus
OMRON CorporationProgramable Terminals NB-DesignerVer.1.63 or loweraffected

Weaknesses

  • CWE-611: CWE-611 Improper Restriction of XML External Entity Reference

Workarounds

OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.

  1. Secure Communication Function The secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.
  • NJ series, NX1P2 CPU Unit: Version 1.49 or higher

  1. Anti-virus protection Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.

  2. Security measures to prevent unauthorized access

  • Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.
  • Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.
  • Use a virtual private network (VPN) for remote access to control systems and equipment.
  • Use strong passwords and change them frequently.
  • Install physical controls so that only authorized personnel can access control systems and equipment.
  • Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.
  • Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.

  1. Data input and output protection Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.

  2. Data recovery Periodical data backup and maintenance to prepare for data loss.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References