Omron Corporation vulnerabilities
33 vulnerabilities
Known vulnerabilities in Omron Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 25 products.
Products
25- CX Programmer15 vulnerabilities
- Machine Automation Controller NJ Series2 vulnerabilities
- Machine Automation Controller NX Series2 vulnerabilities
- CJ2H CPU Unit1 vulnerabilities
- CJ2M CPU Unit1 vulnerabilities
- CP1L El20Dr D1 vulnerabilities
- Cs/Cj Series Ethernet/Ip Unit1 vulnerabilities
- CX Designer1 vulnerabilities
- CX Drive1 vulnerabilities
- CX Drive All Models1 vulnerabilities
- CX Motion Pro1 vulnerabilities
- CX Motion MCH1 vulnerabilities
- CX One CX One Cxone Al[][]D V41 vulnerabilities
- FA Integrated Tool Package CX One1 vulnerabilities
- Machine Automation Controller NJ Series1 vulnerabilities
- Machine Automation Controller NJ Series, Machine Automation Controller NX Series, Automation Software 'Sysmac Studio', And Programmable Terminal (PT) NA Series1 vulnerabilities
- Machine Automation Controller NX Series1 vulnerabilities
- Multiple Omron Products Which Implement FINS Protocol1 vulnerabilities
- NJ Series CPU Unit1 vulnerabilities
- NX Series CPU Unit1 vulnerabilities
- Omron CX Supervisor1 vulnerabilities
- Programable Terminals NB Designer1 vulnerabilities
- Sysmac Studio Software1 vulnerabilities
- Sysmac Studio Sysmac Se2[][][]1 vulnerabilities
- Sysmac Se2[][][]1 vulnerabilities
CVE-2021-20836omron corporationomron cx-supervisor+1
EPSS score0.81%
Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privileges to cause information disclosure and/or arbitrary code execution by opening a specially crafted SCS project files.CVE-2025-1384omron corporationmachine automation controller nj-series+2EPSS score0.26%
Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the controller products.CVE-2025-0591omron corporationfa integrated tool package cx-oneEPSS score0.18%
Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.CVE-2022-21219omron corporationcx-programmer+1EPSS score1.03%
Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.CVE-2022-21124omron corporationcx-programmer+1EPSS score1.51%
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25234.CVE-2022-25325omron corporationcx-programmer+1EPSS score1.08%
Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25230.CVE-2022-25230omron corporationcx-programmer+1EPSS score1.08%
Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25325.CVE-2022-25234omron corporationcx-programmer+1EPSS score1.03%
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-21124.CVE-2022-43508omron corporationcx-programmer+1EPSS score0.26%
Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.CVE-2022-43509omron corporationcx-programmer+1EPSS score0.25%
Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.CVE-2022-43667omron corporationcx-programmer+1EPSS score0.28%
Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.CVE-2022-46282omron corporationcx-drive+1EPSS score0.25%
Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specially crafted file,CVE-2022-33971omron corporationmachine automation controller nj series, machine automation controller nx series, automation software 'sysmac studio', and programmable terminal (pt) na series+52EPSS score1.24%
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models V 1.48 and earlier, which may allow an adjacent attacker who can analyze the communication between the controller and the specific software used by OMRON internally to cause a denial-of-service (DoS) condition or execute a malicious program.CVE-2024-31413omron corporationcx-one cx-one cxone-al[][]d-v4+1EPSS score0.24%
Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower, and was updated through CX-One V4 auto update in January 2024 or prior) and Sysmac Studio SYSMAC-SE2[][][] (The version which was installed with a DVD ver. 1.56 or lower, and was updated through Sysmac Studio V1 auto update in January 2024 or prior). Opening a specially crafted project file may lead to arbitrary code execution.CVE-2024-31412omron corporationcx-programmerEPSS score0.24%
Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver. 9.81 or lower. Opening a specially crafted project file may lead to information disclosure and/or the product being crashed.CVE-2024-27121omron corporationmachine automation controller nj series+1EPSS score0.88%
Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request sent from a remote attacker with an administrative privilege. As for the details of the affected product names/versions, see the information provided by the vendor under [References] section.CVE-2024-49501omron corporationsysmac-se2[][][]EPSS score0.18%
Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attacker may access the program which is protected by Data Protection function.CVE-2024-12298omron corporationprogramable terminals nb-designerEPSS score0.22%
We found a vulnerability Improper Restriction of XML External Entity Reference (CWE-611) in NB-series NX-Designer. Attackers may be able to abuse this vulnerability to disclose confidential data on a computer.CVE-2024-12083omron corporationmachine automation controller nj-series+1EPSS score0.68%
Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.CVE-2024-33687omron corporationnj series cpu unit+1EPSS score0.19%
Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.