CVE-2022-45793

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Omron	Sysmac Studio	<= 1.54.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-04Third Party Advisory, US Government Resource
https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/Third Party Advisory
https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-009_en.pdfVendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-04Third Party Advisory, US Government Resource
https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/Third Party Advisory
https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-009_en.pdfVendor Advisory

Timeline

Published: Jan 10, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-457947.5An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and writ CVE-2022-457967.2Command injection vulnerability in nw_interface.html in SHARP multifunction printers (MFPs)'s Digital Full-color Multifunctional System 202 CVE-2022-457977.1An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Servic CVE-2022-457987.8A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could al CVE-2022-45805.4The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputti CVE-2022-458015.4Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications tha CVE-2022-458029.8Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users CVE-2022-458038.8Missing Authorization vulnerability in Nikolay Strikhar WordPress Form Builder Plugin – Gutenberg Forms.This issue affects WordPress Form Bu CVE-2022-458045.4Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to ga CVE-2022-458059.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paytm Paytm Payment Gateway paytm-paym CVE-2022-458069.8Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control CVE-2022-458078.8Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions.