Omron vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-1384 Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac StHigh 7 · Jul 13, 2025
• CVE-2025-0591 Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer.High 7.8 · Feb 16, 2025
• CVE-2024-33687 Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions.High 7.5 · Jun 24, 2024
• CVE-2024-31412 Out-of-bounds read vulnerability exists in CX-Programmer included in CX-One CXONE-AL[][]D-V4 Ver.High 7.8 · May 1, 2024
• CVE-2024-27121 Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series.High 7.2 · Mar 12, 2024
• CVE-2022-45792 Project files may contain malicious contents which the software will use to create files on the filesystem.High 7.8 · Jan 22, 2024
• CVE-2022-45790 The Omron FINS protocol has an authenticated feature to prevent access to memory regions.High 8.6 · Jan 22, 2024
• CVE-2022-45794 An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC iHigh 8.6 · Jan 10, 2024
• CVE-2023-22277 Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.High 7.8 · Aug 3, 2023
• CVE-2023-22317 Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.High 7.8 · Aug 3, 2023
• CVE-2023-22314 Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.High 7.8 · Aug 3, 2023
• CVE-2023-38748 Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.High 7.8 · Aug 3, 2023
• CVE-2023-38747 Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.High 7.8 · Aug 3, 2023
• CVE-2023-38746 Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.High 7.8 · Aug 3, 2023
• CVE-2023-38744 Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of the CJ Series CJ2 CHigh 7.5 · Aug 3, 2023
• CVE-2023-27396 FINS (Factory Interface Network Service) is a message communication protocol, which is designed to be used in closed FA (Factory Automation) networks, and is usCritical 9.8 · Jun 19, 2023
• CVE-2023-27385 Heap-based buffer overflow vulnerability exists in CX-Drive All models all versions.High 7.8 · May 10, 2023
• CVE-2023-0811 Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored.Critical 9.1 · Mar 16, 2023
• CVE-2023-22366 CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability.High 7.8 · Jan 17, 2023
• CVE-2023-22357 Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being executed without authentiCritical 9.8 · Jan 17, 2023
• CVE-2022-46282 Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specially crafted file,High 7.8 · Dec 21, 2022
• CVE-2022-43667 Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution bHigh 7.8 · Dec 6, 2022
• CVE-2022-43509 Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by havingHigh 7.8 · Dec 6, 2022
• CVE-2022-43508 Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a usHigh 7.8 · Dec 6, 2022
• CVE-2022-3398 OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code.High 7.8 · Oct 6, 2022