#VU112872 Least Privilege Violation in Omron products - CVE-2025-1384

Vulnerability identifier: #VU112872

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2025-1384

CWE-ID: CWE-272

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Machine Automation Controller NJ101-xxxx
Machine Automation Controller NJ301-1x00
Machine Automation Controller NJ501-1x00
Machine Automation Controller NJ501-1x20
Machine Automation Controller NJ501-1340
Machine Automation Controller NJ501-4xxxx
Machine Automation Controller NJ501-5300
Machine Automation Controller NJ501-Rx00
Machine Automation Controller NJ501-Rx20
Machine Automation Controller NX102-xxxxx
Machine Automation Controller NX1P2-xxxxxxx
Machine Automation Controller NX1P2-xxxxxxx1
Machine Automation Controller NX502-xxxxx
Machine Automation Controller NX701-xxxxx
SYSMAC-SE2xx

Software vendor:
Omron

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to least privilege violation issue in the communication function. A remote attacker can perform arbitrary operations and execute arbitrary code on the system.

Install updates from vendor's website.

• https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-004_en.pdf
• https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-004_ja.pdf
• https://jvn.jp/en/vu/JVNVU96149970/index.html