Priority LOW 30
Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00264 · Published 2025-07-13 · No fix listed CWE-272
Priority LOW 35
Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00176 · Published 2025-02-16 · No fix listed CWE-125
Priority LOW 32
Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers.
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.00681 · Published 2025-01-14 · No fix listed CWE-22
Priority LOW 24
We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00225 · Published 2025-01-14 · No fix listed CWE-611
Priority LOW 25
Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability.
CVSS 3.0MEDIUM 5.7· Local · No auth · No interaction · EPSS 0.0018 · Published 2024-11-01 · No fix listed CWE-863
Priority LOW 32
Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00193 · Published 2024-06-24 · No fix listed CWE-345
Priority LOW 28
Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver.
CVSS 3.1MEDIUM 5.9· Local · No auth · No interaction · EPSS 0.00238 · Published 2024-05-01 · No fix listed CWE-761
Priority LOW 36
Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00245 · Published 2024-05-01 · No fix listed CWE-125
Priority LOW 35
Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0088 · Published 2024-03-12 · No fix listed CWE-22
Priority LOW 36
Project files may contain malicious contents which the software will use to create files on the filesystem.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00326 · Published 2024-01-22 · Fixed in 1.54.0 CWE-22
Priority MEDIUM 47
The Omron FINS protocol has an authenticated feature to prevent access to memory regions.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00905 · Published 2024-01-22 · Fixed in 1.5, 2.1 +3 CWE-307
Priority MEDIUM 40
An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC internal memory and memory card.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00536 · Published 2024-01-10 · No fix listed CWE-306
Priority LOW 36
Sysmac Studio installs executables in a directory with poor permissions.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00275 · Published 2024-01-10 · No fix listed CWE-276
Priority LOW 24
CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00211 · Published 2023-10-23 · No fix listed CWE-611
Priority LOW 36
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00238 · Published 2023-08-03 · No fix listed CWE-416
Priority LOW 36
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00238 · Published 2023-08-03 · No fix listed CWE-416
Priority LOW 36
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00238 · Published 2023-08-03 · No fix listed CWE-416
Priority LOW 35
Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00218 · Published 2023-08-03 · No fix listed CWE-416
Priority LOW 36
Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00241 · Published 2023-08-03 · No fix listed CWE-787
Priority LOW 35
Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00218 · Published 2023-08-03 · No fix listed CWE-125
Priority MEDIUM 40
Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series E…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00866 · Published 2023-08-03 · No fix listed CWE-1284
Priority MEDIUM 52
FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01374 · Published 2023-06-19 · No fix listed CWE-306
Priority LOW 35
Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00226 · Published 2023-05-10 · No fix listed CWE-787
Priority MEDIUM 46
Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00621 · Published 2023-03-16 · No fix listed CWE-284
Priority LOW 24
Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier.
CVSS 3.1MEDIUM 5.5· Local · No auth · User interaction · EPSS 0.00211 · Published 2023-01-30 · No fix listed CWE-611
Load more
THREATIST.IORead the docs