Pc10g-cpu Tcc-6353 Firmware: Insufficient Verification of Data Authenticity

What to do

1. Check which version of Pc10g-cpu Tcc-6353 Firmware you run against the affected versions below, and install the vendor's latest release.
2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

JTEKT TOYOPUC PLCs through 2022-04-29 do not ensure data integrity. They utilize the unauthenticated CMPLink/TCP protocol for engineering purposes, including downloading projects and control logic to the PLC. Control logic is downloaded to the PLC on a block-by-block basis with a given memory address and a blob of machine code. The logic that is downloaded to the PLC is not cryptographically authenticated, allowing an attacker to execute arbitrary machine code on the PLC's CPU module in the context of the runtime. In the case of the PC10G-CPU, and likely for other CPU modules of the TOYOPUC family, a processor without MPU or MMU is used and this no memory protection or privilege-separation capabilities are available, giving an attacker full control over the CPU.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Insufficient Verification of Data Authenticity

Timeline

1. July 26, 2022CVE record published.
2. June 17, 2026Record last changed materially (score, affected products, status or references).

References

Other vulnerabilities in Pc10g-cpu Tcc-6353 Firmware

• 9.1 Critical severity

  pc10g-cpu_tcc-6353_firmware: Missing Authentication for Critical Functionality

  CVE-2022-29951Jul 26, 2022JtektEPSS 1.32%

Recent Insufficient Verification of Data Authenticity vulnerabilities

• 7.2 High severity

  Ace1000 Firmware: Insufficient Verification of Data Authenticity

  CVE-2022-30272Jul 26, 2022Motorola
• 8.8 High severity

  Ace1000 Firmware: Insufficient Verification of Data Authenticity

  CVE-2022-30269Jul 26, 2022Motorola
• 7.5 High severity

  Lvskihp Outdoorunit Firmware: Insufficient Verification of Data Authenticity

  CVE-2022-28370Jul 14, 2022Verizon
• 7.5 High severity

  OPC UA Modicon Communication Module: Insufficient Verification of Data Authenticity

  CVE-2022-34763Jul 13, 2022Schneider Electric
• 7.2 High severity

  Cisco Adaptive Security Appliance (ASA) Software: Insufficient Verification of Data Authenticity

  CVE-2022-20829Jun 24, 2022CiscoEPSS 3.74%
• 10.0 High severity

  MULTIPROG: Insufficient Verification of Data Authenticity

  CVE-2022-31801Jun 21, 2022Phoenix ContactEPSS 1.16%

Spotted an error? Tell us.