Least Privilege Violation in Omron products - CVE-2025-1384

Vulnerability identifier: #VU112872

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-1384

CWE-ID: CWE-272

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to least privilege violation issue in the communication function. A remote attacker can perform arbitrary operations and execute arbitrary code on the system.

Machine Automation Controller NJ101-xxxx
Machine Automation Controller NJ301-1x00
Machine Automation Controller NX701-xxxxx
Machine Automation Controller NJ501-1x00
Machine Automation Controller NX502-xxxxx
Machine Automation Controller NJ501-1x20
Machine Automation Controller NX1P2-xxxxxxx1
Machine Automation Controller NJ501-1340
Machine Automation Controller NX1P2-xxxxxxx
Machine Automation Controller NJ501-4xxxx
Machine Automation Controller NX102-xxxxx
Machine Automation Controller NJ501-5300
Machine Automation Controller NJ501-Rx20
Machine Automation Controller NJ501-Rx00
SYSMAC-SE2xx

Install updates from vendor's website.

Machine Automation Controller NJ101-xxxx - update to 1.69.00
Machine Automation Controller NJ301-1x00 - update to 1.69.00
Machine Automation Controller NX701-xxxxx - update to 1.36.00
Machine Automation Controller NJ501-1x00 - update to 1.69.00
Machine Automation Controller NX502-xxxxx - update to 1.69.00
Machine Automation Controller NJ501-1x20 - update to 1.69.00
Machine Automation Controller NX1P2-xxxxxxx1 - update to 1.69.00
Machine Automation Controller NJ501-1340 - update to 1.69.00
Machine Automation Controller NX1P2-xxxxxxx - update to 1.69.00
Machine Automation Controller NJ501-4xxxx - update to 1.69.00
Machine Automation Controller NX102-xxxxx - update to 1.69.00
Machine Automation Controller NJ501-5300 - update to 1.69.00
Machine Automation Controller NJ501-Rx20 - update to 1.69.00
Machine Automation Controller NJ501-Rx00 - update to 1.69.00
SYSMAC-SE2xx - update to 1.69.00

• https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-004_en.pdf
• https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-004_ja.pdf
• https://jvn.jp/en/vu/JVNVU96149970/index.html

• Remote code execution in OMRON NJ/NX series Machine Automation Controllers