Omron

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-33687 1Omron 55Nj Pa3001 Firmware Nj Pd3001 FirmwareNj101 1000 Firmware+52 more Jun 17, 2026 Jun 24, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to det...Show more Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.Show less
CVE-2022-45792 1Omron 1Sysmac Studio Jun 17, 2026 Jan 22, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user.
CVE-2022-45790 1Omron 46Cj1g Cpu42p Firmware Cj1g Cpu43p FirmwareCj1g Cpu44p Firmware+43 more Jun 17, 2026 Jan 22, 2024 N/A· v4 9.1 CRITICAL· v3 N/A· v2 The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access c...Show more The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including programmed logic.Show less
CVE-2022-45794 1Omron 41Sysmac Cj1g Cpu42p Firmware Sysmac Cj1g Cpu43p FirmwareSysmac Cj1g Cpu44p Firmware+38 more Jun 17, 2026 Jan 10, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC internal memory and memory card.
CVE-2022-45793 1Omron 1Automation Software Sysmac Studio Jun 17, 2026 Jan 10, 2024 N/A· v4 7.8 HIGH· v3 N/A· v2 Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.
CVE-2023-22277 1Omron 1Cx Programmer Jun 17, 2026 Aug 3, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is diffe...Show more Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22317 and CVE-2023-22314.Show less
CVE-2023-22317 1Omron 1Cx Programmer Jun 17, 2026 Aug 3, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is diffe...Show more Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22314.Show less
CVE-2023-22314 1Omron 1Cx Programmer Jun 17, 2026 Aug 3, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is diffe...Show more Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22317.Show less
CVE-2023-38748 1Omron 1Cx Programmer Jun 17, 2026 Aug 3, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may o...Show more Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.Show less
CVE-2023-38747 1Omron 1Cx Programmer Jun 17, 2026 Aug 3, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code exe...Show more Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.Show less
CVE-2023-38746 1Omron 1Cx Programmer Jun 17, 2026 Aug 3, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execu...Show more Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.Show less
CVE-2023-38744 1Omron 12Cj1w Eip21 Firmware Cj2h Cpu64 Eip FirmwareCj2h Cpu65 Eip Firmware+9 more Jun 17, 2026 Aug 3, 2023 N/A· v4 7.5 HIGH· v3 N/A· v2 Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series E...Show more Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product receives a packet which is specially crafted by a remote unauthenticated attacker, the unit of the affected product may fall into a denial-of-service (DoS) condition. Affected products/versions are as follows: CJ2M CPU Unit CJ2M-CPU3[] Unit version of the built-in EtherNet/IP section Ver. 2.18 and earlier, CJ2H CPU Unit CJ2H-CPU6[]-EIP Unit version of the built-in EtherNet/IP section Ver. 3.04 and earlier, CS/CJ Series EtherNet/IP Unit CS1W-EIP21 V3.04 and earlier, and CS/CJ Series EtherNet/IP Unit CJ1W-EIP21 V3.04 and earlier.Show less
CVE-2023-27396 1Omron 271Cj2h Cpu64 Eip Firmware Cj2h Cpu64 FirmwareCj2h Cpu65 Eip Firmware+268 more Jun 17, 2026 Jun 19, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON...Show more FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues -- (1)Plaintext communication, and (2)No authentication required. When FINS messages are intercepted, the contents may be retrieved. When arbitrary FINS messages are injected, any commands may be executed on, or the system information may be retrieved from, the affected device. Affected products and versions are as follows: SYSMAC CS-series CPU Units, all versions, SYSMAC CJ-series CPU Units, all versions, SYSMAC CP-series CPU Units, all versions, SYSMAC NJ-series CPU Units, all versions, SYSMAC NX1P-series CPU Units, all versions, SYSMAC NX102-series CPU Units, all versions, and SYSMAC NX7 Database Connection CPU Units (Ver.1.16 or later)Show less
CVE-2023-27385 1Omron 1Cx Drive Jun 17, 2026 May 10, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions. By having a user open a specially crafted SDD file, arbitrary code may be executed and/or information may be disclosed.
CVE-2023-0811 1Omron 128Sysmac Cj2h Cpu64 Eip Firmware Sysmac Cj2h Cpu64 FirmwareSysmac Cj2h Cpu65 Eip Firmware+125 more Jun 17, 2026 Mar 16, 2023 N/A· v4 9.1 CRITICAL· v3 N/A· v2 Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the...Show more Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM protections or setting a non-ASCII password (non-keyboard characters) and preventing an engineer from viewing or modifying the user program. Show less
CVE-2023-22322 1Omron 1Cx Motion Pro Jun 17, 2026 Jan 30, 2023 N/A· v4 5.5 MEDIUM· v3 N/A· v2 Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, sensitive informatio...Show more Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. If a user opens a specially crafted project file created by an attacker, sensitive information in the file system where CX-Motion Pro is installed may be disclosed.Show less
CVE-2023-22366 1Omron 1Cx Motion Mch Firmware Jun 17, 2026 Jan 17, 2023 N/A· v4 7.8 HIGH· v3 N/A· v2 CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
CVE-2023-22357 1Omron 1Cp1l El20dr D Firmware Jun 17, 2026 Jan 17, 2023 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote unauthenticated attacker may read/write in...Show more Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote unauthenticated attacker may read/write in arbitrary area of the device memory, which may lead to overwriting the firmware, causing a denial-of-service (DoS) condition, and/or arbitrary code execution.Show less
CVE-2022-46282 1Omron 1Cx Drive Jun 17, 2026 Dec 21, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specially crafted file,
CVE-2022-43667 1Omron 1Cx Programmer Jun 17, 2026 Dec 7, 2022 N/A· v4 7.8 HIGH· v3 N/A· v2 Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.

12 3 4 5 Next