Omron vulnerabilities, page 4

83 vulnerabilities

Known vulnerabilities in Omron products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 514 products.

9.8CriticalCVE-2022-3396omron · cx-programmerOMRON CX-Programmer Out-of-bounds WriteOMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.EPSS0.71%9.8CriticalCVE-2022-3397omron · cx-programmerOMRON CX-Programmer Out-of-bounds WriteOMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.EPSS0.71%9.8CriticalCVE-2022-3398omron · cx-programmerOMRON CX-Programmer Out-of-bounds WriteOMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.EPSS0.71%9.4CriticalCVE-2022-34151omron corporation · machine automation controller nj series, machine automation controller nx series, automation software 'sysmac studio', and programmable terminal (pt) na series +57 moreomron corporation machine automation controller nj series, machine automation controller nx series, automation software 'sysmac studio', and programmable terminal (pt) na seriesUse of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.EPSS1.26%8.3HighCVE-2022-33971omron corporation · machine automation controller nj series, machine automation controller nx series, automation software 'sysmac studio', and programmable terminal (pt) na series +52 moreomron corporation machine automation controller nj series, machine automation controller nx series, automation software 'sysmac studio', and programmable terminal (pt) na seriesAuthentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.EPSS1.24%8.1HighCVE-2022-33208omron corporation · machine automation controller nj series, machine automation controller nx series, automation software 'sysmac studio', and programmable terminal (pt) na series +57 moreomron corporation machine automation controller nj series, machine automation controller nx series, automation software 'sysmac studio', and programmable terminal (pt) na seriesAuthentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller.EPSS1.87%10CriticalCVE-2000-0704freewnn +2 morefreewnn freewnnBuffer overflow in SGI Omron WorldView Wnn allows remote attackers to execute arbitrary commands via long JS_OPEN, JS_MKDIR, or JS_FILE_INFO commands.EPSS13.10%8.8HighCVE-2019-18251omron · cx-supervisor +1 moreomron cx-supervisorIn Omron CX-Supervisor, Versions 3.5 (12) and prior, Omron CX-Supervisor ships with Teamviewer Version 5.0.8703 QS. This version of Teamviewer is vulnerable to an obsolete function vulnerability requiring user interaction to exploit.EPSS1.74%9.8CriticalCVE-2019-18269omron · omron plc cj series +2 moreomron omron plc cj seriesOmron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability.EPSS1.05%7.8HighCVE-2019-10971omron · network_configurator_for_devicenet_safetyomron network_configurator_for_devicenet_safetyThe application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the intended directories.EPSS1.06%6.8MediumCVE-2019-6556omron · common_components +2 moreomron common_componentsWhen processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.EPSS1.15%9.1CriticalCVE-2023-0811omron · cj1m sysmac cj-series +130 moreomron cj1m sysmac cj-seriesOmron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program.EPSS0.62%7.8HighCVE-2023-27385omron corporation · cx-drive all models +1 moreomron corporation cx-drive all modelsHeap-based buffer overflow vulnerability exists in CX-Drive All models all versions. By having a user open a specially crafted SDD file, arbitrary code may be executed and/or information may be disclosed.EPSS0.23%9.8CriticalCVE-2023-27396omron corporation · multiple omron products which implement fins protocol +264 moreomron corporation multiple omron products which implement fins protocolFINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues -- (1)Plaintext communication, and (2)No authentication required. When FINS messages are intercepted, the contents may be retrieved. When arbitrary FINS messages are injected, any commands may be executed on, or the system information may be retrieved from, the affected device. Affected products and versions are as follows: SYSMAC CS-series CPU Units, all versions, SYSMAC CJ-series CPU Units, all versions, SYSMAC CP-series CPU Units, all versions, SYSMAC NJ-series CPU Units, all versions, SYSMAC NX1P-series CPU Units, all versions, SYSMAC NX102-series CPU Units, all versions, and SYSMAC NX7 Database Connection CPU Units (Ver.1.16 or later)EPSS1.37%7.8HighCVE-2023-38748omron corporation · cx-programmer +1 moreomron corporation cx-programmerUse after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.EPSS0.22%7.8HighCVE-2023-38746omron corporation · cx-programmer +1 moreomron corporation cx-programmerOut-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.EPSS0.22%7.5HighCVE-2023-38744omron corporation · cj2h cpu unit +14 moreomron corporation cj2h cpu unitDenial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.EPSS0.87%7.8HighCVE-2023-38747omron corporation · cx-programmer +1 moreomron corporation cx-programmerHeap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.EPSS0.24%7.8HighCVE-2023-22317omron corporation · cx-programmer +1 moreomron corporation cx-programmerUse after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22314.EPSS0.24%7.8HighCVE-2023-22366omron corporation · cx-motion-mch +1 moreomron corporation cx-motion-mchCX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.EPSS0.20%