CVE-2014-2369 (GCVE-0-2014-2369)

Vulnerability from cvelistv5 – Published: 2014-07-24 14:00 – Updated: 2025-10-06 17:59
VLAI?
Summary
Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Omron NS15 Affected: 8.1xx , < 8.68x (custom)
Create a notification for this product.
    Omron NS12 Affected: 8.1xx , < 8.68x (custom)
Create a notification for this product.
    Omron NS10 Affected: 8.1xx , < 8.68x (custom)
Create a notification for this product.
    Omron NS8 Affected: 8.1xx , < 8.68x (custom)
Create a notification for this product.
    Omron NS5 Affected: 8.1xx , < 8.68x (custom)
Create a notification for this product.
Credits
Joel Sevilleja Febrer of S2 Grupo
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:14:25.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NS15",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NS12",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NS10",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NS8",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NS5",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joel Sevilleja Febrer of S2 Grupo"
        }
      ],
      "datePublic": "2014-07-22T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.\u003c/p\u003e"
            }
          ],
          "value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-06T17:59:20.171Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
        },
        {
          "url": "https://automation.omron.com/en/us/products/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOmron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\u003c/p\u003e\n\u003cp\u003eNS15 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS12 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS10 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS8 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS5 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Omron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\n\n\nNS15 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html \n\nNS12 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html \n\nNS10 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html \n\nNS8 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html \n\nNS5 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html"
        }
      ],
      "source": {
        "advisory": "ICSA-14-203-01",
        "discovery": "UNKNOWN"
      },
      "title": "Omron NS Series HMI Cross-Site Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-2369",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01",
              "refsource": "MISC",
              "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-2369",
    "datePublished": "2014-07-24T14:00:00",
    "dateReserved": "2014-03-13T00:00:00",
    "dateUpdated": "2025-10-06T17:59:20.171Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:omron:ns_series_system_program_firmware:8.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8246BB5A-986B-4AA0-B3A2-645976E8E7AF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:omron:ns_series_system_program_firmware:8.68:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"58C930D1-BA9F-4643-8321-B160A018C5D9\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:omron:ns10_hmi_terminal:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"31B221BA-8C11-41E2-836A-3007022AB5DE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:omron:ns12_hmi_terminal:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E804153-AE32-4FE1-920F-FF648A2B2FE0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:omron:ns15_hmi_terminal:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F78DF368-D063-42D2-ABD4-ABD63BF22842\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:omron:ns5_hmi_terminal:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"076C5660-3EBF-4318-B3C6-BF28596EB99E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:omron:ns8_hmi_terminal:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"112E9FC7-96BB-4E5F-8697-8E0E48A80914\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de CSRF en la aplicaci\\u00f3n web en los terminales HMI Omron NS5, NS8, NS10, NS12 y NS15 8.1xx hasta 8.68x permite a usuarios remotos autenticados secuestrar la autenticaci\\u00f3n de victimas no especificadas a trav\\u00e9s de vectores desconocidos.\"}]",
      "id": "CVE-2014-2369",
      "lastModified": "2024-11-21T02:06:09.870",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 6.8, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2014-07-24T14:55:07.287",
      "references": "[{\"url\": \"http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01\", \"source\": \"ics-cert@hq.dhs.gov\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}]",
      "sourceIdentifier": "ics-cert@hq.dhs.gov",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-2369\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2014-07-24T14:55:07.287\",\"lastModified\":\"2025-10-06T18:15:48.690\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de CSRF en la aplicaci\u00f3n web en los terminales HMI Omron NS5, NS8, NS10, NS12 y NS15 8.1xx hasta 8.68x permite a usuarios remotos autenticados secuestrar la autenticaci\u00f3n de victimas no especificadas a trav\u00e9s de vectores desconocidos.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:H/Au:S/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"HIGH\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:P/A:P\",\"baseScore\":6.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.8,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:omron:ns_series_system_program_firmware:8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8246BB5A-986B-4AA0-B3A2-645976E8E7AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:omron:ns_series_system_program_firmware:8.68:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"58C930D1-BA9F-4643-8321-B160A018C5D9\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:omron:ns10_hmi_terminal:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31B221BA-8C11-41E2-836A-3007022AB5DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:omron:ns12_hmi_terminal:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E804153-AE32-4FE1-920F-FF648A2B2FE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:omron:ns15_hmi_terminal:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F78DF368-D063-42D2-ABD4-ABD63BF22842\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:omron:ns5_hmi_terminal:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"076C5660-3EBF-4318-B3C6-BF28596EB99E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:omron:ns8_hmi_terminal:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"112E9FC7-96BB-4E5F-8697-8E0E48A80914\"}]}]}],\"references\":[{\"url\":\"https://automation.omron.com/en/us/products/\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.