jvn.jp
https://jvn.jp/en/vu/JVNVU95852116/index.html CVE-2024-27121
HIGH
Record summary
CVE-2024-27121 has a selected CVSS score of 7.2 (high).
Description
Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request sent from a remote attacker with an administrative privilege. As for the details of the affected product names/versions, see the information provided by the vendor under [References] section.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 12, 2024 · Source: CVE List
Affected products and versions
5| Product | Source | Version range | Status |
|---|---|---|---|
Machine Automation Controller NJ SeriesBrowse OMRON Corporation / Machine Automation Controller NJ Series | CVE List | NJ101-[][][][] Ver.1.64.03 and earlier | affected |
| NJ301-[][][][] Ver.1.64.00 and earlier | affected | ||
| NJ501-1[]0[] Ver.1.64.03 and earlier | affected | ||
| NJ501-1[]2[] Ver.1.64.00 and earlier | affected | ||
| NJ501-1340 Ver.1.64.00 and earlier | affected | ||
| NJ501-4[][][] Ver.1.64.00 and earlier | affected | ||
| NJ501-5300 Ver.1.64.00 and earlier | affected | ||
| NJ501-R[][][] Ver.1.64.00 and earlier | affected | ||
Machine Automation Controller NX SeriesBrowse OMRON Corporation / Machine Automation Controller NX Series | CVE List | NX102-[][][][] Ver.1.64.00 and earlier | affected |
| NX502-[][][][] Ver.1.65.01 and earlier | affected | ||
| NX701-[][][][] Ver.1.35.00 and earlier | affected | ||
| NX-EIP201 Ver.1.00.01 and earlier | affected | ||
| NX1P2-[][][][][][] Ver.1.64.00 and earlier | affected | ||
| NX1P2-[][][][][][]1 Ver.1.64.00 and earlier | affected | ||
nj101-9020_firmwareBrowse omron / nj101-9020_firmwareDefault status: unknown | CVE List | Through 1.64.03 | affected |
nj301-1200_firmwareBrowse omron / nj301-1200_firmwareDefault status: unknown | CVE List | Through 1.64.00 | affected |
nj501-r520_firmwareBrowse omron / nj501-r520_firmwareDefault status: unknown | CVE List | Through 1.64.00 | affected |
References
4nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-27121 fa.omron.co.jp
https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-001_en.pdf fa.omron.co.jp
https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2024-001_ja.pdf