Vulnerability-Lookup

VAR-201407-0238

Vulnerability from variot - Updated: 2025-10-07 23:12

Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron's touch screen HMI programming software. Allows remote attackers to perform unauthorized operations with specially crafted data. This may lead to further attacks. The following products are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals versions 8.1xx to 8.68x

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201407-0238",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ns series system program",
        "scope": "eq",
        "trust": 2.2,
        "vendor": "omron",
        "version": "8.1"
      },
      {
        "model": "ns series system program",
        "scope": "eq",
        "trust": 2.2,
        "vendor": "omron",
        "version": "8.68"
      },
      {
        "model": "ns8 hmi terminal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns12 hmi terminal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns10 hmi terminal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns5 hmi terminal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns15 hmi terminal",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns10",
        "scope": null,
        "trust": 0.8,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns12",
        "scope": null,
        "trust": 0.8,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns15",
        "scope": null,
        "trust": 0.8,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns5",
        "scope": null,
        "trust": 0.8,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns8",
        "scope": null,
        "trust": 0.8,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns series software",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "omron",
        "version": "8.1xx to  8.68x"
      },
      {
        "model": "ns15 hmi terminal",
        "scope": null,
        "trust": 0.6,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns12 hmi terminal",
        "scope": null,
        "trust": 0.6,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns10 hmi terminal",
        "scope": null,
        "trust": 0.6,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns8 hmi terminal",
        "scope": null,
        "trust": 0.6,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns5 hmi terminal",
        "scope": null,
        "trust": 0.6,
        "vendor": "omron",
        "version": null
      },
      {
        "model": "ns8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.68"
      },
      {
        "model": "ns8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.1"
      },
      {
        "model": "ns5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.68"
      },
      {
        "model": "ns5",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.1"
      },
      {
        "model": "ns15",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.68"
      },
      {
        "model": "ns15",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.1"
      },
      {
        "model": "ns12",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.68"
      },
      {
        "model": "ns12",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.1"
      },
      {
        "model": "ns10",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.68"
      },
      {
        "model": "ns10",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.1"
      },
      {
        "model": "ns8",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.7"
      },
      {
        "model": "ns5",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.7"
      },
      {
        "model": "ns15",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.7"
      },
      {
        "model": "ns12",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.7"
      },
      {
        "model": "ns10",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "omron",
        "version": "8.7"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "ns series system program",
        "version": "8.1"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "ns series system program",
        "version": "8.68"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "ns10 hmi terminal",
        "version": null
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "ns12 hmi terminal",
        "version": null
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "ns15 hmi terminal",
        "version": null
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "ns5 hmi terminal",
        "version": null
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "ns8 hmi terminal",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "db": "BID",
        "id": "68834"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2369"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/h:omron_2:ns10_hmi_terminal",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:omron_2:ns12_hmi_terminal",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:omron_2:ns15_hmi_terminal",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:omron_2:ns5_hmi_terminal",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:omron_2:ns8_hmi_terminal",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:omron_2:ns_series_system_program_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Joel Sevilleja Febrer of S2 Grupo",
    "sources": [
      {
        "db": "BID",
        "id": "68834"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-2369",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.8,
            "id": "CVE-2014-2369",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.8,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "ics-cert@hq.dhs.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "CVE-2014-2369",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.8,
            "id": "CNVD-2014-04727",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "IVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.8,
            "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.2,
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 6.8,
            "id": "VHN-70308",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "ics-cert@hq.dhs.gov",
            "id": "CVE-2014-2369",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-2369",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-2369",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2014-04727",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201407-595",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "IVD",
            "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d",
            "trust": 0.2,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-70308",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70308"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2369"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2369"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron\u0027s touch screen HMI programming software. Allows remote attackers to perform unauthorized operations with specially crafted data. This may lead to  further attacks. The following products are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals versions 8.1xx to 8.68x",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-2369"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "db": "BID",
        "id": "68834"
      },
      {
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70308"
      }
    ],
    "trust": 2.7
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-2369",
        "trust": 3.6
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-14-203-01",
        "trust": 3.4
      },
      {
        "db": "BID",
        "id": "68834",
        "trust": 1.0
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-595",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727",
        "trust": 0.8
      },
      {
        "db": "JVN",
        "id": "JVNVU97798872",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "E2E5FEF4-2351-11E6-ABEF-000C29C66E3D",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-70308",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70308"
      },
      {
        "db": "BID",
        "id": "68834"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2369"
      }
    ]
  },
  "id": "VAR-201407-0238",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70308"
      }
    ],
    "trust": 1.6361111166666666
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      }
    ]
  },
  "last_update_date": "2025-10-07T23:12:16.171000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Scalable HMI",
        "trust": 0.8,
        "url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/default.html"
      },
      {
        "title": "NS5, NS8, NS10, NS12, NS15, NSH5-V2",
        "trust": 0.8,
        "url": "http://www.fa.omron.co.jp/products/family/155/download/catalog.html"
      },
      {
        "title": "Patch for Omron NS series HMI Terminals Cross-Site Request Forgery Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/48034"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-352",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-70308"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2369"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "http://ics-cert.us-cert.gov/advisories/icsa-14-203-01"
      },
      {
        "trust": 1.0,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
      },
      {
        "trust": 1.0,
        "url": "https://automation.omron.com/en/us/products/"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2369"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu97798872/"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2369"
      },
      {
        "trust": 0.3,
        "url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70308"
      },
      {
        "db": "BID",
        "id": "68834"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2369"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "db": "VULHUB",
        "id": "VHN-70308"
      },
      {
        "db": "BID",
        "id": "68834"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-2369"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-07-31T00:00:00",
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "date": "2014-07-31T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "date": "2014-07-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-70308"
      },
      {
        "date": "2014-07-22T00:00:00",
        "db": "BID",
        "id": "68834"
      },
      {
        "date": "2014-07-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      },
      {
        "date": "2014-07-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "date": "2014-07-24T14:55:07.287000",
        "db": "NVD",
        "id": "CVE-2014-2369"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-07-31T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      },
      {
        "date": "2014-07-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-70308"
      },
      {
        "date": "2014-07-22T00:00:00",
        "db": "BID",
        "id": "68834"
      },
      {
        "date": "2014-07-29T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      },
      {
        "date": "2014-07-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-003553"
      },
      {
        "date": "2025-10-06T18:15:48.690000",
        "db": "NVD",
        "id": "CVE-2014-2369"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Omron NS series HMI Terminals Cross-Site Request Forgery Vulnerability",
    "sources": [
      {
        "db": "IVD",
        "id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2014-04727"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "cross-site request forgery",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201407-595"
      }
    ],
    "trust": 0.6
  }
}

CVE-2014-2369 (GCVE-0-2014-2369)

Vulnerability from cvelistv5 – Published: 2014-07-24 14:00 – Updated: 2025-10-06 17:59

Title

Omron NS Series HMI Cross-Site Request Forgery

Summary

Severity

No CVSS data available.

CWE

CWE-352

Assigner

icscert CNA under the icscert root

CNA scorecard B 75/100 over 349 records in the last 180 days details

References

3 references

URL	Tags
https://www.cisa.gov/news-events/ics-advisories/i…
https://automation.omron.com/en/us/products/
http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01	x_refsource_MISCx_transferred

Impacted products

5 products

Vendor	Product	Version
Omron	NS15	Affected: 8.1xx , < 8.68x (custom)
Omron	NS12	Affected: 8.1xx , < 8.68x (custom)
Omron	NS10	Affected: 8.1xx , < 8.68x (custom)
Omron	NS8	Affected: 8.1xx , < 8.68x (custom)
Omron	NS5	Affected: 8.1xx , < 8.68x (custom)

Date Public

2014-07-22 06:00

Credits

Joel Sevilleja Febrer of S2 Grupo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:14:25.244Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "NS15",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NS12",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NS10",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NS8",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "NS5",
          "vendor": "Omron",
          "versions": [
            {
              "lessThan": "8.68x",
              "status": "affected",
              "version": "8.1xx",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joel Sevilleja Febrer of S2 Grupo"
        }
      ],
      "datePublic": "2014-07-22T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.\u003c/p\u003e"
            }
          ],
          "value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-06T17:59:20.171Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
        },
        {
          "url": "https://automation.omron.com/en/us/products/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOmron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\u003c/p\u003e\n\u003cp\u003eNS15 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS12 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS10 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS8 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS5 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Omron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\n\n\nNS15 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html \n\nNS12 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html \n\nNS10 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html \n\nNS8 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html \n\nNS5 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html"
        }
      ],
      "source": {
        "advisory": "ICSA-14-203-01",
        "discovery": "UNKNOWN"
      },
      "title": "Omron NS Series HMI Cross-Site Request Forgery",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-2369",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01",
              "refsource": "MISC",
              "url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-2369",
    "datePublished": "2014-07-24T14:00:00.000Z",
    "dateReserved": "2014-03-13T00:00:00.000Z",
    "dateUpdated": "2025-10-06T17:59:20.171Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted