Omron NS Series HMI Improper Neutralization of Input During Web Page Generation
Priority LOW 22CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
Why it matters now
EPSS 0.01362 71st percentileScored 2026-11-07
Fix Fixed NS15 (Omron): 8.68xNS12 (Omron): 8.68x+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OMRON Corporation | NS15 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
| OMRON Corporation | NS12 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
| OMRON Corporation | NS10 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
| OMRON Corporation | NS8 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
| OMRON Corporation | NS5 | 8.1xx to before 8.68x | 8.68x | Patch available | CNA |
- NS15 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
- NS12 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
- NS10 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
- NS8 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
- NS5 VendorOMRON Corporation Affected 8.1xx to before 8.68x Fixed in 8.68x Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:omron:ns_series_system_program_firmware:8.1:*:*:*:*:*:*:* | 8.1 | Vulnerable | OMRON Corporation |
| cpe:2.3:o:omron:ns_series_system_program_firmware:8.68:*:*:*:*:*:*:* | 8.68 | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns10_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns12_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns15_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns5_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
| cpe:2.3:h:omron:ns8_hmi_terminal:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | OMRON Corporation |
- cpe:2.3:o:omron:ns_series_system_program_firmware:8.1:*:*:*:*:*:*:* Versions 8.1 Vulnerable ·OMRON Corporation
- cpe:2.3:o:omron:ns_series_system_program_firmware:8.68:*:*:*:*:*:*:* Versions 8.68 Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns10_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns12_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns15_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns5_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
- cpe:2.3:h:omron:ns8_hmi_terminal:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OMRON Corporation
Remediation
- Fix · CNA NS15 (Omron) Fixed in 8.68x
- Fix · CNA NS12 (Omron) Fixed in 8.68x
- Fix · CNA NS10 (Omron) Fixed in 8.68x
- Fix · CNA NS8 (Omron) Fixed in 8.68x
- Fix · CNA NS5 (Omron) Fixed in 8.68x
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Omron NS10, NS12 and 3 more products 8.68x
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2014-01884 Omron NS Series HMI Cross-Site Request ForgeryPriority LOW 28
Timeline
- 2026-10-02 Threatist record created from CVE-2014-2370
- 2026-10-03 Alias added: GHSA-c4v2-5pvc-3vr9
References
More OMRON Corporation Ns10 Hmi Terminal vulnerabilities
- TI-2014-01884 Omron NS Series HMI Cross-Site Request Forgery CVSS 2.0MEDIUM 6.0
Sources
- CVE-2014-2370 · CVE Program
- CVE-2014-2370 · NVD
- FIRST EPSS
- GHSA-c4v2-5pvc-3vr9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences