Vulnerability-Lookup

GHSA-X8P6-6QW8-J7RJ

Vulnerability from github – Published: 2025-01-14 03:31 – Updated: 2025-01-14 03:31

Details

Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.

Severity

6.6 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-12083"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-14T01:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.",
  "id": "GHSA-x8p6-6qw8-j7rj",
  "modified": "2025-01-14T03:31:40Z",
  "published": "2025-01-14T03:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12083"
    },
    {
      "type": "WEB",
      "url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-001_en.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-001_ja.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2024-12083 (GCVE-0-2024-12083)

Vulnerability from cvelistv5 – Published: 2025-01-14 00:46 – Updated: 2025-05-06 23:55

Title

Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers

Summary

Severity

6.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

OMRON

References

2 references

URL	Tags
https://www.fa.omron.co.jp/product/security/asset…
https://www.fa.omron.co.jp/product/security/asset…

Impacted products

15 products

Vendor	Product	Version
OMRON Corporation	Machine Automation Controller NJ-series	Affected: NJ101-[][][][] Ver.1.64.05 and lower
OMRON Corporation	Machine Automation Controller NJ-series	Affected: NJ301-[][][][] Ver.1.64.05 and lower
OMRON Corporation	Machine Automation Controller NJ-series	Affected: NJ501-1[]0[] Ver.1.64.05 and lower
OMRON Corporation	Machine Automation Controller NJ-series	Affected: NJ501-1[]2[] Ver.1.64.04 and lower
OMRON Corporation	Machine Automation Controller NJ-series	Affected: NJ501-1340 Ver.1.64.04 and lower
OMRON Corporation	Machine Automation Controller NJ-series	Affected: NJ501-4[][][] Ver.1.64.04 and lower
OMRON Corporation	Machine Automation Controller NJ-series	Affected: NJ501-5300 Ver.1.64.04 and lower
OMRON Corporation	Machine Automation Controller NJ-series	Affected: NJ501-R[][][] Ver.1.64.04 and lower
OMRON Corporation	Machine Automation Controller NX-series	Affected: NX1P2-[][][][][][] Ver.1.64.04 and lower
OMRON Corporation	Machine Automation Controller NX-series	Affected: NX1P2-[][][][][][]1 Ver.1.64.04 and lower
OMRON Corporation	Machine Automation Controller NX-series	Affected: NX102-[][]0[] Ver.1.64.07 and lower
OMRON Corporation	Machine Automation Controller NX-series	Affected: NX102-[][]2[] Ver.1.64.07 and lower
OMRON Corporation	Machine Automation Controller NX-series	Affected: NX502-[][][][] Ver.1.66.03 and lower
OMRON Corporation	Machine Automation Controller NX-series	Affected: NX701-[][][][] Ver.1.35.04 and lower
OMRON Corporation	Machine Automation Controller NX-series	Affected: NX-EIP201 Ver.1.01.02 and lower

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12083",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-14T15:28:53.612862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-14T15:29:28.690Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "packageName": "NJ101-[][][][]",
          "product": "Machine Automation Controller NJ-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NJ101-[][][][] Ver.1.64.05 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NJ301-[][][][]",
          "product": "Machine Automation Controller NJ-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NJ301-[][][][] Ver.1.64.05 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NJ501-1[]0[]",
          "product": "Machine Automation Controller NJ-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NJ501-1[]0[] Ver.1.64.05 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NJ501-1[]2[]",
          "product": "Machine Automation Controller NJ-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NJ501-1[]2[] Ver.1.64.04 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NJ501-1340",
          "product": "Machine Automation Controller NJ-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NJ501-1340 Ver.1.64.04 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NJ501-4[][][]",
          "product": "Machine Automation Controller NJ-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NJ501-4[][][] Ver.1.64.04 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NJ501-5300",
          "product": "Machine Automation Controller NJ-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NJ501-5300 Ver.1.64.04 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NJ501-R[][][]",
          "product": "Machine Automation Controller NJ-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NJ501-R[][][] Ver.1.64.04 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NX1P2-[][][][][][]",
          "product": "Machine Automation Controller NX-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NX1P2-[][][][][][] Ver.1.64.04 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NX1P2-[][][][][][]1",
          "product": "Machine Automation Controller NX-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NX1P2-[][][][][][]1 Ver.1.64.04 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NX102-[][]0[]",
          "product": "Machine Automation Controller NX-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NX102-[][]0[] Ver.1.64.07 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NX102-[][]2[]",
          "product": "Machine Automation Controller NX-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NX102-[][]2[] Ver.1.64.07 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NX502-[][][][]",
          "product": "Machine Automation Controller NX-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NX502-[][][][] Ver.1.66.03 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NX701-[][][][]",
          "product": "Machine Automation Controller NX-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NX701-[][][][] Ver.1.35.04 and lower"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "NX-EIP201",
          "product": "Machine Automation Controller NX-series",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "NX-EIP201 Ver.1.01.02 and lower"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products."
            }
          ],
          "value": "Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-06T23:55:36.575Z",
        "orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
        "shortName": "OMRON"
      },
      "references": [
        {
          "url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-001_en.pdf"
        },
        {
          "url": "https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-001_ja.pdf"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The countermeasure against the vulnerabilities can be implemented by updating each product to the countermeasure version.\u003cbr\u003eFor information on how to obtain and update the firmware for the countermeasure version of the product, please contact our sales office or distributors. \u003cbr\u003e"
            }
          ],
          "value": "The countermeasure against the vulnerabilities can be implemented by updating each product to the countermeasure version.\nFor information on how to obtain and update the firmware for the countermeasure version of the product, please contact our sales office or distributors."
        }
      ],
      "source": {
        "advisory": "OMSR-2025-001",
        "discovery": "UNKNOWN"
      },
      "title": "Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\u003cbr\u003e\u003cbr\u003e1.  Secure Communication Function\u003cbr\u003eThe secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.\u003cbr\u003e-NJ series, NX102, NX1P2 CPU Unit: Version 1.49 or higher\u003cbr\u003e-NX701 CPU Unit: Version 1.29 or higher\u003cbr\u003e-NX502 CPU Unit: Version 1.60 or higher\u003cbr\u003e-NX-EIP201 EtherNet/IPTM Unit: Version 1.00 or higher\u003cbr\u003e\u003cbr\u003e2.  Anti-virus protection\u003cbr\u003eProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\u003cbr\u003e\u003cbr\u003e3.  Security measures to prevent unauthorized access\u003cbr\u003e-  Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\u003cbr\u003e-  Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\u003cbr\u003e-  Use a virtual private network (VPN) for remote access to control systems and equipment.\u003cbr\u003e-  Use strong passwords and change them frequently.\u003cbr\u003e-  Install physical controls so that only authorized personnel can access control systems and equipment.\u003cbr\u003e-  Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\u003cbr\u003e-  Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\u003cbr\u003e\u003cbr\u003e4.  Data input and output protection\u003cbr\u003eValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\u003cbr\u003e\u003cbr\u003e5.  Data recovery\u003cbr\u003ePeriodical data backup and maintenance to prepare for data loss.\u003cbr\u003e"
            }
          ],
          "value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\n\n1.  Secure Communication Function\nThe secure communication function can prevent data from being eavesdropped or tampered with by a third party. Secure communication is available in the following CPU Units of the stated versions.\n-NJ series, NX102, NX1P2 CPU Unit: Version 1.49 or higher\n-NX701 CPU Unit: Version 1.29 or higher\n-NX502 CPU Unit: Version 1.60 or higher\n-NX-EIP201 EtherNet/IPTM Unit: Version 1.00 or higher\n\n2.  Anti-virus protection\nProtect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\n\n3.  Security measures to prevent unauthorized access\n-  Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\n-  Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\n-  Use a virtual private network (VPN) for remote access to control systems and equipment.\n-  Use strong passwords and change them frequently.\n-  Install physical controls so that only authorized personnel can access control systems and equipment.\n-  Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\n-  Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\n\n4.  Data input and output protection\nValidation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\n\n5.  Data recovery\nPeriodical data backup and maintenance to prepare for data loss."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
    "assignerShortName": "OMRON",
    "cveId": "CVE-2024-12083",
    "datePublished": "2025-01-14T00:46:33.399Z",
    "dateReserved": "2024-12-03T04:43:25.034Z",
    "dateUpdated": "2025-05-06T23:55:36.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-X8P6-6QW8-J7RJ

CVE-2024-12083 (GCVE-0-2024-12083)

Tags

Sightings

Nomenclature