{"id":"CVE-2023-38744","aliases":["EUVD-2023-42519","GHSA-8262-vqgw-h22m"],"status":"published","title":"Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue...","description":"Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00866,"percentile":0.58999,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1284"],"published":"2023-08-03T04:55:52Z","modified":"2026-06-17T06:11:05Z","products":[{"vendor":"omron","product":"cj1w-eip21_firmware"},{"vendor":"omron","product":"cj2h-cpu64-eip_firmware"},{"vendor":"omron","product":"cj2h-cpu65-eip_firmware"},{"vendor":"omron","product":"cj2h-cpu66-eip_firmware"},{"vendor":"omron","product":"cj2h-cpu67-eip_firmware"},{"vendor":"omron","product":"cj2h-cpu68-eip_firmware"},{"vendor":"omron","product":"cj2h_cpu_unit"},{"vendor":"omron","product":"cj2m-cpu31_firmware"},{"vendor":"omron","product":"cj2m-cpu32_firmware"},{"vendor":"omron","product":"cj2m-cpu33_firmware"},{"vendor":"omron","product":"cj2m-cpu34_firmware"},{"vendor":"omron","product":"cj2m-cpu35_firmware"},{"vendor":"omron","product":"cj2m_cpu_unit"},{"vendor":"omron","product":"cs1w-eip21_firmware"},{"vendor":"omron","product":"cs_cj_series_ethernet_ip_unit"},{"vendor":"omron corporation","product":"cj2h cpu unit"},{"vendor":"omron corporation","product":"cj2m cpu unit"},{"vendor":"omron corporation","product":"cs/cj series ethernet/ip unit"}],"references":[{"url":"https://www.ia.omron.com/product/vulnerability/OMSR-2023-006_en.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://jvn.jp/en/vu/JVNVU92193064/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38744"},{"url":"https://jvn.jp/en/vu/JVNVU92193064"},{"url":"https://github.com/advisories/GHSA-8262-vqgw-h22m"}],"sources":{"cve":[{"id":"CVE-2023-38744","description":"Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.","status":"published","published":"2023-08-03T04:55:52.423Z","modified":"2024-10-17T15:17:34.756Z","cwes":["CWE-1284"],"updated_at":"2026-11-02T14:35:30.116696Z"}],"euvd":[{"id":"EUVD-2023-42519","description":"Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.","status":"published","published":"2023-08-03T04:55:52Z","modified":"2024-10-17T15:17:34Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"none"}],"updated_at":"2026-11-03T00:27:34.339903Z"}],"ghsa":[{"id":"GHSA-8262-vqgw-h22m","title":"Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue...","description":"Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.","status":"published","published":"2023-08-03T06:30:23Z","modified":"2024-10-17T18:32:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:58:32.565259Z"}],"nvd":[{"id":"CVE-2023-38744","description":"Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.","status":"published","published":"2023-08-03T05:15:10.417Z","modified":"2026-06-17T06:11:05.203Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:08:20.798312Z"}]}}