Search criteria
5 vulnerabilities
CVE-2025-9818 (GCVE-0-2025-9818)
Vulnerability from cvelistv5 – Published: 2025-09-17 03:02 – Updated: 2025-09-17 13:40
VLAI?
Summary
A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces.
Severity ?
6.7 (Medium)
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OMRON SOCIAL SOLUTIONS CO., Ltd. | PowerAttendant Standard Edition |
Affected:
0 , ≤ 2.0.0
(semver)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-9818",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-17T13:38:49.600285Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-17T13:40:05.543Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "PowerAttendant Standard Edition",
"vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
"versions": [
{
"lessThanOrEqual": "2.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "PowerAttendant Basic Edition",
"vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
"versions": [
{
"lessThanOrEqual": "1.1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "PowerAct Pro \u003cSlave Agent\u003e",
"vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
"versions": [
{
"lessThanOrEqual": "5.20",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "PowerAct Pro \u003cMaster Agent\u003e",
"vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
"versions": [
{
"lessThanOrEqual": "5.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Simple Shutdown Software",
"vendor": "OMRON SOCIAL SOLUTIONS CO., Ltd.",
"versions": [
{
"lessThanOrEqual": "2.51",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces."
}
],
"value": "A vulnerability (CWE-428) has been identified in the Uninterruptible Power Supply (UPS) management application provided by OMRON SOCIAL SOLUTIONS Co., Ltd., where the executable file paths of Windows services are not enclosed in quotation marks. If the installation folder path of this product contains spaces, there is a possibility that unauthorized files may be executed under the service privileges by using paths containing spaces."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "No direct mapping"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428 Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-17T03:02:20.527Z",
"orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"shortName": "OMRON"
},
"references": [
{
"url": "https://www.omron.com/jp/ja/inquiry/vulnerability_information/OMSR-2025-005_ja.pdf"
},
{
"url": "https://www.omron.com/global/en/inquiry/vulnerability_information/OMSR-2025-005_en.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"assignerShortName": "OMRON",
"cveId": "CVE-2025-9818",
"datePublished": "2025-09-17T03:02:20.527Z",
"dateReserved": "2025-09-02T07:03:10.550Z",
"dateUpdated": "2025-09-17T13:40:05.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-1384 (GCVE-0-2025-1384)
Vulnerability from cvelistv5 – Published: 2025-07-13 23:42 – Updated: 2025-07-14 14:15
VLAI?
Summary
Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the controller products.
Severity ?
CWE
- CWE-272 - Least Privilege Violation
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1384",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-14T14:14:22.828617Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-14T14:15:23.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "NJ101-[][][][]",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ101-[][][][] Ver.1.67.00 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ301-1[]00",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ301-1[]00 Ver.1.67.00 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-1[]00",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-1[]00 Ver.1.67.02 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-1[]20",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-1[]20 Ver.1.68.01 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-1340",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-1340 Ver.1.67.00 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-4[][][]",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-4[][][] Ver.1.67.00 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-5300",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-5300 Ver.1.67.01 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-R[]00",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-R[]00 Ver.1.67.01 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-R[]20",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-R[]20 Ver.1.67.00 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX102-[][][][]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX102-[][][][] Ver.1.68.01 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX1P2-[][][][][][]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX1P2-[][][][][][] Ver.1.64.09 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX1P2-[][][][][][]1",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX1P2-[][][][][][]1 Ver.1.64.09 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX502-[][][][]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX502-[][][][] Ver.1.68.01 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX701-[][][][]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX701-[][][][] Ver.1.35.09 or lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "SYSMAC-SE2[][][]",
"product": "Sysmac Studio Software",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "SYSMAC-SE2[][][] all"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the controller products."
}
],
"value": "Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the controller products."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-272",
"description": "CWE-272 Least Privilege Violation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-13T23:42:09.953Z",
"orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"shortName": "OMRON"
},
"references": [
{
"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-004_en.pdf"
},
{
"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-004_ja.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The countermeasure against the vulnerability can be implemented by updating each product to the countermeasure version and setting the secure communication version 2.\u003cbr\u003eFor information on how to obtain and update the firmware for the countermeasure version of the product, please contact our sales office or distributors. \u003cbr\u003e"
}
],
"value": "The countermeasure against the vulnerability can be implemented by updating each product to the countermeasure version and setting the secure communication version 2.\nFor information on how to obtain and update the firmware for the countermeasure version of the product, please contact our sales office or distributors."
}
],
"source": {
"advisory": "OMSR-2025-004",
"discovery": "UNKNOWN"
},
"title": "Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of this vulnerability.\u003cbr\u003e\u003cbr\u003e1. Secure Communication Function\u003cbr\u003eThe secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.\u003cbr\u003e- NJ series, NX102, NX1P2 CPU Unit: Version 1.49 or higher\u003cbr\u003e- NX701 CPU Unit: Version 1.29 or higher\u003cbr\u003e- NX502 CPU Unit: Version 1.60 or higher\u003cbr\u003e\u003cbr\u003e2. Anti-virus protection\u003cbr\u003eProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\u003cbr\u003e\u003cbr\u003e3. Security measures to prevent unauthorized access\u003cbr\u003e- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\u003cbr\u003e- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\u003cbr\u003e- Use a virtual private network (VPN) for remote access to control systems and equipment.\u003cbr\u003e- Use strong passwords and change them frequently.\u003cbr\u003e- Install physical controls so that only authorized personnel can access control systems and equipment.\u003cbr\u003e- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\u003cbr\u003e- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\u003cbr\u003e\u003cbr\u003e4. Data input and output protection\u003cbr\u003eValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\u003cbr\u003e\u003cbr\u003e5. Data recovery\u003cbr\u003ePeriodical data backup and maintenance to prepare for data loss.\u003cbr\u003e"
}
],
"value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of this vulnerability.\n\n1. Secure Communication Function\nThe secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.\n- NJ series, NX102, NX1P2 CPU Unit: Version 1.49 or higher\n- NX701 CPU Unit: Version 1.29 or higher\n- NX502 CPU Unit: Version 1.60 or higher\n\n2. Anti-virus protection\nProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\n\n3. Security measures to prevent unauthorized access\n- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\n- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\n- Use a virtual private network (VPN) for remote access to control systems and equipment.\n- Use strong passwords and change them frequently.\n- Install physical controls so that only authorized personnel can access control systems and equipment.\n- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\n- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\n\n4. Data input and output protection\nValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\n\n5. Data recovery\nPeriodical data backup and maintenance to prepare for data loss."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"assignerShortName": "OMRON",
"cveId": "CVE-2025-1384",
"datePublished": "2025-07-13T23:42:09.953Z",
"dateReserved": "2025-02-16T23:57:46.232Z",
"dateUpdated": "2025-07-14T14:15:23.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0591 (GCVE-0-2025-0591)
Vulnerability from cvelistv5 – Published: 2025-02-16 23:58 – Updated: 2025-02-18 16:06
VLAI?
Summary
Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.
Severity ?
7.8 (High)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OMRON Corporation | FA Integrated Tool Package CX-One |
Affected:
Ver.9.83 or lower
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-18T16:06:06.684155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T16:06:14.940Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"packageName": "CX-Programmer",
"product": "FA Integrated Tool Package CX-One",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.9.83 or lower"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability."
}
],
"value": "Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-16T23:58:32.165Z",
"orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"shortName": "OMRON"
},
"references": [
{
"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-003_en.pdf"
},
{
"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-003_ja.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Update your CX-Programmer to the countermeasure version to fix the vulnerability.\u003cbr\u003eFor information on how to obtain and update the countermeasure version of the product, please contact our sales representative or distributor. You can update CX-One to the latest versions using the installed Omron Automation Software AutoUpdate tool.\u003cbr\u003e"
}
],
"value": "Update your CX-Programmer to the countermeasure version to fix the vulnerability.\nFor information on how to obtain and update the countermeasure version of the product, please contact our sales representative or distributor. You can update CX-One to the latest versions using the installed Omron Automation Software AutoUpdate tool."
}
],
"source": {
"advisory": "OMSR-2025-003",
"discovery": "UNKNOWN"
},
"title": "Out-of-bounds Read vulnerability in CX-Programmer",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\u003cbr\u003e\u003cbr\u003e1. Anti-virus protection Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\u003cbr\u003e\u003cbr\u003e2. Security measures to prevent unauthorized access\u003cbr\u003e- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\u003cbr\u003e- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\u003cbr\u003e- Use a virtual private network (VPN) for remote access to control systems and equipment.\u003cbr\u003e- Use strong passwords and change them frequently.\u003cbr\u003e- Install physical controls so that only authorized personnel can access control systems and equipment.\u003cbr\u003e- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\u003cbr\u003e- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\u003cbr\u003e\u003cbr\u003e3. Data input and output protection Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\u003cbr\u003e\u003cbr\u003e4. Data recovery Periodical data backup and maintenance to prepare for data loss.\u003cbr\u003e"
}
],
"value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\n\n1. Anti-virus protection Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\n\n2. Security measures to prevent unauthorized access\n- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\n- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\n- Use a virtual private network (VPN) for remote access to control systems and equipment.\n- Use strong passwords and change them frequently.\n- Install physical controls so that only authorized personnel can access control systems and equipment.\n- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\n- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\n\n3. Data input and output protection Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\n\n4. Data recovery Periodical data backup and maintenance to prepare for data loss."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"assignerShortName": "OMRON",
"cveId": "CVE-2025-0591",
"datePublished": "2025-02-16T23:58:32.165Z",
"dateReserved": "2025-01-20T06:13:11.242Z",
"dateUpdated": "2025-02-18T16:06:14.940Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12083 (GCVE-0-2024-12083)
Vulnerability from cvelistv5 – Published: 2025-01-14 00:46 – Updated: 2025-05-06 23:55
VLAI?
Summary
Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.
Severity ?
6.6 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| OMRON Corporation | Machine Automation Controller NJ-series |
Affected:
NJ101-[][][][] Ver.1.64.05 and lower
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12083",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-14T15:28:53.612862Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-14T15:29:28.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "NJ101-[][][][]",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ101-[][][][] Ver.1.64.05 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ301-[][][][]",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ301-[][][][] Ver.1.64.05 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-1[]0[]",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-1[]0[] Ver.1.64.05 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-1[]2[]",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-1[]2[] Ver.1.64.04 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-1340",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-1340 Ver.1.64.04 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-4[][][]",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-4[][][] Ver.1.64.04 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-5300",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-5300 Ver.1.64.04 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NJ501-R[][][]",
"product": "Machine Automation Controller NJ-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NJ501-R[][][] Ver.1.64.04 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX1P2-[][][][][][]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX1P2-[][][][][][] Ver.1.64.04 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX1P2-[][][][][][]1",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX1P2-[][][][][][]1 Ver.1.64.04 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX102-[][]0[]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX102-[][]0[] Ver.1.64.07 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX102-[][]2[]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX102-[][]2[] Ver.1.64.07 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX502-[][][][]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX502-[][][][] Ver.1.66.03 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX701-[][][][]",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX701-[][][][] Ver.1.35.04 and lower"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "NX-EIP201",
"product": "Machine Automation Controller NX-series",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "NX-EIP201 Ver.1.01.02 and lower"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products."
}
],
"value": "Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-06T23:55:36.575Z",
"orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"shortName": "OMRON"
},
"references": [
{
"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-001_en.pdf"
},
{
"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-001_ja.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The countermeasure against the vulnerabilities can be implemented by updating each product to the countermeasure version.\u003cbr\u003eFor information on how to obtain and update the firmware for the countermeasure version of the product, please contact our sales office or distributors. \u003cbr\u003e"
}
],
"value": "The countermeasure against the vulnerabilities can be implemented by updating each product to the countermeasure version.\nFor information on how to obtain and update the firmware for the countermeasure version of the product, please contact our sales office or distributors."
}
],
"source": {
"advisory": "OMSR-2025-001",
"discovery": "UNKNOWN"
},
"title": "Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\u003cbr\u003e\u003cbr\u003e1. Secure Communication Function\u003cbr\u003eThe secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.\u003cbr\u003e-NJ series, NX102, NX1P2 CPU Unit: Version 1.49 or higher\u003cbr\u003e-NX701 CPU Unit: Version 1.29 or higher\u003cbr\u003e-NX502 CPU Unit: Version 1.60 or higher\u003cbr\u003e-NX-EIP201 EtherNet/IPTM Unit: Version 1.00 or higher\u003cbr\u003e\u003cbr\u003e2. Anti-virus protection\u003cbr\u003eProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\u003cbr\u003e\u003cbr\u003e3. Security measures to prevent unauthorized access\u003cbr\u003e- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\u003cbr\u003e- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\u003cbr\u003e- Use a virtual private network (VPN) for remote access to control systems and equipment.\u003cbr\u003e- Use strong passwords and change them frequently.\u003cbr\u003e- Install physical controls so that only authorized personnel can access control systems and equipment.\u003cbr\u003e- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\u003cbr\u003e- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\u003cbr\u003e\u003cbr\u003e4. Data input and output protection\u003cbr\u003eValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\u003cbr\u003e\u003cbr\u003e5. Data recovery\u003cbr\u003ePeriodical data backup and maintenance to prepare for data loss.\u003cbr\u003e"
}
],
"value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\n\n1. Secure Communication Function\nThe secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.\n-NJ series, NX102, NX1P2 CPU Unit: Version 1.49 or higher\n-NX701 CPU Unit: Version 1.29 or higher\n-NX502 CPU Unit: Version 1.60 or higher\n-NX-EIP201 EtherNet/IPTM Unit: Version 1.00 or higher\n\n2. Anti-virus protection\nProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\n\n3. Security measures to prevent unauthorized access\n- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\n- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\n- Use a virtual private network (VPN) for remote access to control systems and equipment.\n- Use strong passwords and change them frequently.\n- Install physical controls so that only authorized personnel can access control systems and equipment.\n- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\n- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\n\n4. Data input and output protection\nValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\n\n5. Data recovery\nPeriodical data backup and maintenance to prepare for data loss."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"assignerShortName": "OMRON",
"cveId": "CVE-2024-12083",
"datePublished": "2025-01-14T00:46:33.399Z",
"dateReserved": "2024-12-03T04:43:25.034Z",
"dateUpdated": "2025-05-06T23:55:36.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-12298 (GCVE-0-2024-12298)
Vulnerability from cvelistv5 – Published: 2025-01-14 00:45 – Updated: 2025-01-14 15:29
VLAI?
Summary
We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer.
Severity ?
5.5 (Medium)
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| OMRON Corporation | Programable Terminals NB-Designer |
Affected:
Ver.1.63 or lower
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12298",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-14T15:29:39.495895Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-14T15:29:49.972Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"packageName": "NB-Designer",
"product": "Programable Terminals NB-Designer",
"vendor": "OMRON Corporation",
"versions": [
{
"status": "affected",
"version": "Ver.1.63 or lower"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer."
}
],
"value": "We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer."
}
],
"impacts": [
{
"capecId": "CAPEC-221",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-221 Data Serialization External Entities Blowup"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-14T00:45:38.605Z",
"orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"shortName": "OMRON"
},
"references": [
{
"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-002_en.pdf"
},
{
"url": "https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-002_ja.pdf"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The countermeasure against the vulnerabilities can be implemented by updating each product to the countermeasure version.\u003cbr\u003eFor information on how to obtain and update the countermeasure version of the product, please contact our sales office or distributors.\u003cbr\u003e"
}
],
"value": "The countermeasure against the vulnerabilities can be implemented by updating each product to the countermeasure version.\nFor information on how to obtain and update the countermeasure version of the product, please contact our sales office or distributors."
}
],
"source": {
"advisory": "OMSR-2025-002",
"discovery": "UNKNOWN"
},
"title": "Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\u003cbr\u003e\u003cbr\u003e1. Secure Communication Function\u003cbr\u003eThe secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.\u003cbr\u003e- NJ series, NX1P2 CPU Unit: Version 1.49 or higher\u003cbr\u003e\u003cbr\u003e2. Anti-virus protection\u003cbr\u003eProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\u003cbr\u003e\u003cbr\u003e3. Security measures to prevent unauthorized access\u003cbr\u003e- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\u003cbr\u003e- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\u003cbr\u003e- Use a virtual private network (VPN) for remote access to control systems and equipment.\u003cbr\u003e- Use strong passwords and change them frequently.\u003cbr\u003e- Install physical controls so that only authorized personnel can access control systems and equipment.\u003cbr\u003e- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\u003cbr\u003e- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\u003cbr\u003e\u003cbr\u003e4. Data input and output protection\u003cbr\u003eValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\u003cbr\u003e\u003cbr\u003e5. Data recovery\u003cbr\u003ePeriodical data backup and maintenance to prepare for data loss.\u003cbr\u003e"
}
],
"value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\n\n1. Secure Communication Function\nThe secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.\n- NJ series, NX1P2 CPU Unit: Version 1.49 or higher\n\n2. Anti-virus protection\nProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\n\n3. Security measures to prevent unauthorized access\n- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\n- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\n- Use a virtual private network (VPN) for remote access to control systems and equipment.\n- Use strong passwords and change them frequently.\n- Install physical controls so that only authorized personnel can access control systems and equipment.\n- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\n- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\n\n4. Data input and output protection\nValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\n\n5. Data recovery\nPeriodical data backup and maintenance to prepare for data loss."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
"assignerShortName": "OMRON",
"cveId": "CVE-2024-12298",
"datePublished": "2025-01-14T00:45:38.605Z",
"dateReserved": "2024-12-06T05:22:07.010Z",
"dateUpdated": "2025-01-14T15:29:49.972Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}