CVE-2023-0811 is a critical improper-access-control flaw (CWE-284) in Omron's SYSMAC CJ1M programmable logic controller: an adversary who can send a PROGRAM AREA WRITE command to a specific memory region can overwrite the stored user-memory (UM) protection password, letting them disable UM protections or lock the legitimate engineer out of their own program, and NVD has published its own Primary CVSS v3.1 score of 9.1 (critical) for the flaw.
Vulnerability summary
9.1
Critical
0.6%
EPSS score (FIRST)
No
CISA KEV catalog
2023-03-16
Published
Vulnerability ID: CVE-2023-0811 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Omron SYSMAC CJ1M programmable controller (NVD's own CPE configuration data for this CVE also lists related SYSMAC CJ2H, CJ2M, CP1E, CP1H, CP1L, CP2E and CS1W series CPU/communication-module firmware sharing the same UM memory-protection mechanism) | — | CJ1M unit firmware v4.0 and prior, per NVD's description; mitigated by enabling the CPU unit's hardware write-protect DIP switch and setting a UM read-protection password, per Omron's advisory OMSR-2023-001 |
What does this mean for affected devices?
CVE-2023-0811 (CWE-284, improper access control) affects Omron's SYSMAC CJ1M programmable logic controller. NVD's description states: "Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program" (NVD).
NVD lists the CVE's status as "Modified" with its own Primary CVSS v3.1 base score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H — the same score and vector that CISA's ICS-CERT submitted as a Secondary rating, so the two agree on severity (NVD).
NVD's own structured platform (CPE) data for this CVE lists 128 distinct vulnerable firmware identifiers spanning not just CJ1M but also Omron's SYSMAC CJ2H, CJ2M, CP1E, CP1H, CP1L, CP2E and CS1W series CPU and communication modules, indicating the vulnerable UM memory-protection mechanism is shared more broadly across Omron's SYSMAC PLC lineup than the CVE's plain-English title alone suggests (NVD).
CISA's advisory ICSA-23-073-01, released the same week as Omron's own vendor notice OMSR-2023-001, places the CJ1M in the Critical Manufacturing sector with worldwide deployment, credits security researcher Sam Hanson of Dragos with reporting the flaw, and states that successful exploitation "could allow an attacker to bypass user memory protections by writing to a specific memory address. An attacker can also overwrite passwords and lock engineers from reading their own memory regions" (CISA ICS Advisory ICSA-23-073-01).
Omron's own recommended countermeasure, per the CISA advisory, is to enable the hardware write-protect DIP switch on the front panel of the CPU unit and to set a UM read-protection password together with the "Prohibit from overwriting to a protected program" option; CISA additionally recommends minimizing network exposure for control-system devices so they are not reachable from the internet, and using a VPN for any required remote access (CISA ICS Advisory ICSA-23-073-01).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0062 (49.9th percentile) as of 2026-11-06 — a high-severity PLC flaw with a confirmed NVD score but no reported in-the-wild exploitation (CISA KEV, FIRST EPSS).
Any Omron SYSMAC CJ1M (or related CJ2/CP1/CP2/CS1-series) controller running firmware that has not had the hardware write-protect switch enabled and a UM password set should be reviewed against Omron's OMSR-2023-001 guidance, and should not be directly reachable from untrusted networks.
Evidence
- Omron CJ1M unit v4.0 and prior has improper access controls on the UM password memory region; a PROGRAM AREA WRITE command to a specific region can overwrite the password, disabling UM protections or locking an engineer out of the program. — NVD
- NVD status 'Modified'; NVD Primary CVSS v3.1 base score 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, matching CISA's Secondary submission. — NVD
- NVD's CPE configuration data for this CVE lists 128 vulnerable firmware identifiers across the SYSMAC CJ1M, CJ2H, CJ2M, CP1E, CP1H, CP1L, CP2E and CS1W module/CPU lines. — NVD
- Affects Critical Manufacturing sector, worldwide deployment; reported by Sam Hanson of Dragos; exploitation 'could allow an attacker to bypass user memory protections ... and lock engineers from reading their own memory regions.' Remediation: enable the hardware write-protect DIP switch and set a UM read-protection password. — CISA ICS Advisory ICSA-23-073-01
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0062 (49.9th percentile) as of 2026-11-06. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can an attacker actually do if they exploit CVE-2023-0811?
By issuing a PROGRAM AREA WRITE command to a specific memory region on an affected Omron SYSMAC CJ1M controller, an attacker can overwrite the stored UM (user memory) password — disabling UM protections entirely or setting a non-ASCII password that locks the legitimate engineer out of viewing or modifying the user program (per NVD; per CISA ICS Advisory ICSA-23-073-01).
Does NVD have its own confirmed severity score for this CVE, or is it only a vendor estimate?
NVD lists its own Primary CVSS v3.1 base score of 9.1 (critical) for CVE-2023-0811, matching the Secondary score CISA's ICS-CERT separately submitted — both agree on the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (per NVD).
How does Omron recommend protecting a SYSMAC CJ1M PLC from this flaw?
Omron's countermeasure, documented in the CISA advisory, is to enable the CPU unit's hardware write-protect DIP switch and to set a UM read-protection password with the 'Prohibit from overwriting to a protected program' option; CISA also recommends keeping control-system devices off the internet and using a VPN for any remote access (per CISA ICS Advisory ICSA-23-073-01).