Log in Start free

OMRON Corporation

Products

ProductCVEsExploitedLatest
CX-Programmer15–May 1, 2024
Machine Automation Controller NJ Series 3–Jul 13, 2025
Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series3–Jul 4, 2022
Machine Automation Controller NX Series3–Jul 13, 2025
CX-Designer1–Oct 23, 2023
CX-Drive1–Dec 21, 2022
CX-Drive All models1–May 10, 2023
CX-Motion-MCH1–Jan 17, 2023
CX-Motion Pro1–Jan 30, 2023
CX-One CX-One CXONE-AL[][]D-V4 1–May 1, 2024
FA Integrated Tool Package CX-One1–Feb 16, 2025
Multiple OMRON products which implement FINS protocol1–Jun 19, 2023
NJ Series CPU Unit1–Jun 24, 2024
NX Series CPU Unit1–Jun 24, 2024
OMRON CX-Supervisor1–Oct 19, 2021
Programable Terminals NB-Designer1–Jan 14, 2025
SYSMAC-SE2[][][]1–Nov 1, 2024
Sysmac Studio Software1–Jul 13, 2025
CJ2H CPU Unit1–Aug 3, 2023
Sysmac Studio SYSMAC-SE2[][][] 1–May 1, 2024
CJ2M CPU Unit1–Aug 3, 2023
CP1L-EL20DR-D1–Jan 17, 2023
CS/CJ Series EtherNet/IP Unit1–Aug 3, 2023

Exploited and recent CVEs

  • CVE-2025-1384 High 7.0 Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers 0.3%
  • CVE-2025-1384 High 7.0 Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers 0.3%
  • CVE-2025-1384 High 7.0 Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers 0.3%
  • CVE-2025-0591 High 7.8 Out-of-bounds Read vulnerability in CX-Programmer 0.2%
  • CVE-2024-12083 Medium 6.6 Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers 0.7%
  • CVE-2024-12083 Medium 6.6 Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers 0.7%
  • CVE-2024-12298 Medium 5.5 Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer 0.2%
  • CVE-2024-49501 Medium 5.7 Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. If this vulnerability is exploited, an attacker may access the program which is protected by Data Protect 0.2%
  • CVE-2024-33687 High 7.5 Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product ma 0.2%
  • CVE-2024-33687 High 7.5 Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product ma 0.2%
  • CVE-2024-31413 Medium 5.9 Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower, and was updated through CX-One V4 auto u 0.2%
  • CVE-2024-31413 Medium 5.9 Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL[][]D-V4 (The version which was installed with a DVD ver. 4.61.1 or lower, and was updated through CX-One V4 auto u 0.2%
  • CVE-2024-31412 High 7.8 Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver. 9.81 or lower. Opening a specially crafted project file may lead to information disclosure and/or the 0.2%
  • CVE-2024-27121 High 7.2 Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code 0.9%
  • CVE-2024-27121 High 7.2 Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code 0.9%
  • CVE-2023-43624 Unrated CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (XXE) vulnerability. If a user opens a specially crafted proj 0.2%
  • CVE-2023-22277 Unrated Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vu 0.2%
  • CVE-2023-22314 Unrated Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vu 0.2%
  • CVE-2023-22317 Unrated Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vu 0.2%
  • CVE-2023-38748 Unrated Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary 0.2%
  • CVE-2023-38747 Unrated Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/o 0.2%
  • CVE-2023-38746 Unrated Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or 0.2%
  • CVE-2023-38744 Unrated Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function o 0.9%
  • CVE-2023-38744 Unrated Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function o 0.9%
  • CVE-2023-38744 Unrated Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function o 0.9%
  • CVE-2023-27396 Critical 9.8 FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON prod 1.4%
  • CVE-2023-27385 High 7.8 Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions. By having a user open a specially crafted SDD file, arbitrary code may be executed and/or information may be disclo 0.2%
  • CVE-2023-22322 Medium 5.5 Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, 0.2%
  • CVE-2023-22366 High 7.8 CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a specially crafted project file may lead to information disclosure and/or arbitrary co 0.2%
  • CVE-2023-22357 Critical 9.8 Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote unauthenticated attacke 1.2%