Omron vulnerabilities
We track 43 vulnerabilities in Omron products across 60+ products. 43 are rated high or critical, and none are known to be exploited. The most recent was published on July 14, 2025.
Latest Omron vulnerabilities
- 7.0 High severity
Machine Automation Controller NJ-series: Least Privilege Violation
Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute
- 7.8 High severity
FA Integrated Tool Package CX-One: Out-of-bounds Read
Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.
- 7.5 High severity
NJ Series CPU Unit: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.
- 7.8 High severity
CX-Programmer: Out-of-bounds Read
Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver. 9.81 or lower. Opening a specially crafted project file may lead to information disclosure and/or the product being crashed.
- 7.2 High severity
Machine Automation Controller NJ Series: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request se
- 7.8 High severity
Sysmac Studio: Improper Limitation of a Pathname to a Restricted Directory
Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user.
- 9.1 Critical severity
CJ-series and CS-series CPU modules: Improper Restriction of Excessive Authentication Attempts
The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values including p
- 7.5 High severity
CJ-series and CS-series CPU modules: Missing Authentication for Critical Functionality
An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC internal memory and memory card.
- 7.8 High severity
Sysmac Studio: Incorrect Default Permissions
Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.
- 7.8 High severity
CX-Programmer: Use After Free
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22317 and CVE-2023-22
- 7.8 High severity
CX-Programmer: Use After Free
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22
- 7.8 High severity
CX-Programmer: Use After Free
Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur. This vulnerability is different from CVE-2023-22277 and CVE-2023-22
- 7.8 High severity
CX-Programmer: Use After Free
Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
- 7.8 High severity
CX-Programmer: Out-of-bounds Write
Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
- 7.8 High severity
CX-Programmer: Out-of-bounds Read
Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.
- 7.5 High severity
CJ2M CPU Unit: Improper Validation of Specified Quantity in Input
Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CPU unit and the communication function of the CS/CJ Series EtherNet/IP unit. If an affected product
- 9.8 Critical severity
Multiple OMRON products which implement FINS…: Missing Authentication for Critical Functionality
FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol c
- 7.8 High severity
CX-Drive All models: Out-of-bounds Write
Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions. By having a user open a specially crafted SDD file, arbitrary code may be executed and/or information may be disclosed.
- 9.1 Critical severity
CJ1M SYSMAC CJ-series: Improper Access Control
Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored. If an adversary issues a PROGRAM AREA WRITE command to a specific memory region, they could overwrite the password. This may lead to disabling UM
- 7.8 High severity
CX-Motion-MCH: Access of Uninitialized Pointer
CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. Having a user to open a specially crafted project file may lead to information disclosure and/or arbitrary code execution.
- 9.8 Critical severity
CP1L-EL20DR-D: Active Debug Code
Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentication. A remote unauthenticated attacker may read/write in arbitrary area of the device memory, whi
- 7.8 High severity
CX-Drive: Use After Free
Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specially crafted file,
- 7.8 High severity
CX-Programmer: Out-of-bounds Write
Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
- 7.8 High severity
CX-Programmer: Out-of-bounds Write
Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
- 7.8 High severity
CX-Programmer: Use After Free
Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file.
- 7.8 High severity
CX-Programmer: Use After Free
Opening a specially crafted file could cause the affected product to fail to release its memory reference potentially resulting in arbitrary code execution.
- 9.8 Critical severity
Sysmac Cs1 Firmware: Improper Verification of Cryptographic Signature
The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol for engineering purposes, including downloading projects and control logic to th
- 9.8 Critical severity
Nx701-1600 Firmware: Improper Verification of Cryptographic Signature
The Omron SYSMAC Nx product family PLCs (NJ series, NY series, NX series, and PMAC series) through 2022-005-18 lack cryptographic authentication. These PLCs are programmed using the SYMAC Studio engineering software (which compiles IEC 61131-3 conformant POU c
- 7.5 High severity
Sysmac Cs1 Firmware: Cleartext Storage of Sensitive Information
In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be read out using the Omron FINS protocol without any further authentication.
- 7.5 High severity
Sysmac Cs1 Firmware: Cleartext Transmission of Sensitive Information
Omron CS series, CJ series, and CP series PLCs through 2022-05-18 use cleartext passwords. They feature a UM Protection setting that allows users or system integrators to configure a password in order to restrict sensitive engineering operations (such as proje
- 8.1 High severity
Machine automation controller NJ series…: Use of Hard-coded Credentials
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and ea
- 7.5 High severity
Machine automation controller NJ series…: Authentication Bypass by Capture-replay
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, and Machine automation controller NJ series all models
- 8.1 High severity
Machine automation controller NJ series…: Authentication Bypass by Capture-replay
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1
- 7.8 High severity
CX-Position: Out-of-bounds Write
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may allow an attacker to locally execute arbitrary code.
- 7.8 High severity
CX-Position: Use After Free
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may allow an attacker to execute arbitrary code.
- 7.8 High severity
CX-Position: Out-of-bounds Write
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to execute arbitrary code.
- 7.8 High severity
CX-Position: Out-of-bounds Write
Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an attacker to execute arbitrary code.
- 7.8 High severity
CX-Programmer: Use After Free
Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerabili
- 7.8 High severity
CX-Programmer: Out-of-bounds Write
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulner
- 7.8 High severity
CX-Programmer: Use After Free
Use after free vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerabili