# cve.now: Omron Corporation

The newest entries naming Omron Corporation as an affected vendor (up to 200), of 61 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-1384](https://cve.now/CVE-2025-1384.md): Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers (CVSS 7.0)
- [CVE-2025-0591](https://cve.now/CVE-2025-0591.md): Out-of-bounds Read vulnerability in CX-Programmer (CVSS 7.8)
- [CVE-2024-12083](https://cve.now/CVE-2024-12083.md): Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers (CVSS 6.6)
- [CVE-2024-12298](https://cve.now/CVE-2024-12298.md): Vulnerability Report on Improper Restriction of XML External Entity Reference in NB-Designer (CVSS 5.5)
- [CVE-2024-49501](https://cve.now/CVE-2024-49501.md): Sysmac Studio provided by OMRON Corporation contains an incorrect authorization vulnerability. (CVSS 5.7)
- [CVE-2024-33687](https://cve.now/CVE-2024-33687.md): Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. (CVSS 7.5)
- [CVE-2024-31413](https://cve.now/CVE-2024-31413.md): Free of pointer not at start of buffer vulnerability exists in CX-One CX-One CXONE-AL\[\]\[\]D-V4 (The version which was installed with a DVD ve (CVSS 5.9)
- [CVE-2024-31412](https://cve.now/CVE-2024-31412.md): Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL\[\]\[\]D-V4 Ver. (CVSS 7.8)
- [CVE-2024-27121](https://cve.now/CVE-2024-27121.md): Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. (CVSS 7.2)
- [CVE-2022-45792](https://cve.now/CVE-2022-45792.md): Directory Traversal in Project File Format allows overwrite (Zip Slip) (CVSS 7.8)
- [CVE-2022-45790](https://cve.now/CVE-2022-45790.md): Omron FINS memory protection susceptible to bruteforce (CVSS 8.6)
- [CVE-2022-45794](https://cve.now/CVE-2022-45794.md): Omron CJ-series and CS-series unauthenticated filesystem access. (CVSS 8.6)
- [CVE-2022-45793](https://cve.now/CVE-2022-45793.md): Executable files writable by low-privileged users in Omron Sysmac Studio (CVSS 5.5)
- [CVE-2023-43624](https://cve.now/CVE-2023-43624.md): CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL\[\]\[\]D-V4) contains an improper restriction of XML external entity reference ( (no CVSS)
- [CVE-2023-22277](https://cve.now/CVE-2023-22277.md): Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. (no CVSS)
- [CVE-2023-22314](https://cve.now/CVE-2023-22314.md): Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. (no CVSS)
- [CVE-2023-22317](https://cve.now/CVE-2023-22317.md): Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. (no CVSS)
- [CVE-2023-38748](https://cve.now/CVE-2023-38748.md): Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL\[\]\[\]D-V4 V9.80 and earlier. (no CVSS)
- [CVE-2023-38747](https://cve.now/CVE-2023-38747.md): Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL\[\]\[\]D-V4 V9.80 and earlier. (no CVSS)
- [CVE-2023-38746](https://cve.now/CVE-2023-38746.md): Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL\[\]\[\]D-V4 V9.80 and earlier. (no CVSS)
- [CVE-2023-38744](https://cve.now/CVE-2023-38744.md): Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of (no CVSS)
- [CVE-2023-27396](https://cve.now/CVE-2023-27396.md): FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) (CVSS 9.8)
- [CVE-2023-27385](https://cve.now/CVE-2023-27385.md): Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions. (CVSS 7.8)
- [CVE-2023-0811](https://cve.now/CVE-2023-0811.md): Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. (CVSS 9.1)
- [CVE-2023-22322](https://cve.now/CVE-2023-22322.md): Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. (CVSS 5.5)
- [CVE-2023-22366](https://cve.now/CVE-2023-22366.md): CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. (CVSS 7.8)
- [CVE-2023-22357](https://cve.now/CVE-2023-22357.md): Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being execu (CVSS 9.8)
- [CVE-2022-46282](https://cve.now/CVE-2022-46282.md): Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a spec (CVSS 7.8)
- [CVE-2022-43667](https://cve.now/CVE-2022-43667.md): Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitr (CVSS 7.8)
- [CVE-2022-43509](https://cve.now/CVE-2022-43509.md): Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code (CVSS 7.8)
- [CVE-2022-43508](https://cve.now/CVE-2022-43508.md): Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code exec (CVSS 7.8)
- [CVE-2022-3396](https://cve.now/CVE-2022-3396.md): OMRON CX-Programmer Out-of-bounds Write (CVSS 7.8)
- [CVE-2022-3398](https://cve.now/CVE-2022-3398.md): OMRON CX-Programmer Out-of-bounds Write (CVSS 7.8)
- [CVE-2022-3397](https://cve.now/CVE-2022-3397.md): OMRON CX-Programmer Out-of-bounds Write (CVSS 7.8)
- [CVE-2022-2979](https://cve.now/CVE-2022-2979.md): Omron CX-Programmer (CVSS 7.8)
- [CVE-2022-34151](https://cve.now/CVE-2022-34151.md): Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automat (CVSS 9.4)
- [CVE-2022-33971](https://cve.now/CVE-2022-33971.md): Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machi (CVSS 8.3)
- [CVE-2022-33208](https://cve.now/CVE-2022-33208.md): Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machi (no CVSS)
- [CVE-2022-26419](https://cve.now/CVE-2022-26419.md): Rockwell Automation Studio 5000 Logix Designer Code Injection (CVSS 7.8)
- [CVE-2022-26022](https://cve.now/CVE-2022-26022.md): Rockwell Automation Studio 5000 Logix Designer Out-of-Bounds Write (CVSS 7.8)
- [CVE-2022-26417](https://cve.now/CVE-2022-26417.md): Rockwell Automation Studio 5000 Logix Designer Use After Free (CVSS 7.8)
- [CVE-2022-25959](https://cve.now/CVE-2022-25959.md): Rockwell Automation Studio 5000 Logix Designer Improper Restriction of Operations within the Bounds of a Memory Buffer (CVSS 7.8)
- [CVE-2022-25325](https://cve.now/CVE-2022-25325.md): Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause inform (no CVSS)
- [CVE-2022-25234](https://cve.now/CVE-2022-25234.md): Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause i (no CVSS)
- [CVE-2022-25230](https://cve.now/CVE-2022-25230.md): Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause inform (no CVSS)
- [CVE-2022-21219](https://cve.now/CVE-2022-21219.md): Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause in (no CVSS)
- [CVE-2022-21124](https://cve.now/CVE-2022-21124.md): Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause i (no CVSS)
- [CVE-2022-21137](https://cve.now/CVE-2022-21137.md): Omron CX-One (CVSS 7.8)
- [CVE-2021-20836](https://cve.now/CVE-2021-20836.md): Out-of-bounds read vulnerability in CX-Supervisor v4.0.0.13 and v4.0.0.16 allows an attacker with administrative privileges to cause informa (no CVSS)
- [CVE-2020-27257](https://cve.now/CVE-2020-27257.md): Omron CX-One (no CVSS)
- [CVE-2020-27261](https://cve.now/CVE-2020-27261.md): Omron CX-One (no CVSS)
- [CVE-2020-27259](https://cve.now/CVE-2020-27259.md): Omron CX-One (no CVSS)
- [CVE-2019-18269](https://cve.now/CVE-2019-18269.md): Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. (CVSS 8.6)
- [CVE-2019-6556](https://cve.now/CVE-2019-6556.md): When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to c (no CVSS)
- [CVE-2018-19027](https://cve.now/CVE-2018-19027.md): Three type confusion vulnerabilities exist in CX-One Versions 4.50 and prior and CX-Protocol Versions 2.0 and prior when processing project (no CVSS)
- [CVE-2018-17913](https://cve.now/CVE-2018-17913.md): A type confusion vulnerability exists when processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, which may allow an at (no CVSS)
- [CVE-2018-17909](https://cve.now/CVE-2018-17909.md): When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed m (no CVSS)
- [CVE-2018-17907](https://cve.now/CVE-2018-17907.md): When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can f (no CVSS)
- [CVE-2018-17905](https://cve.now/CVE-2018-17905.md): When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may oc (no CVSS)
- [CVE-2014-2370](https://cve.now/CVE-2014-2370.md): Omron NS Series HMI Improper Neutralization of Input During Web Page Generation (no CVSS)
- [CVE-2014-2369](https://cve.now/CVE-2014-2369.md): Omron NS Series HMI Cross-Site Request Forgery (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/omron
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.