What’s Vulnerable › Vulnerabilities

CVE-2025-1384: Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-14 · updated 2026-06-17
• Weakness: CWE-272

Description

Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the controller products.

Affected products

• OMRON Corporation Machine Automation Controller NJ-series: through NJ101-[][][][] Ver.1.67.00; through NJ301-1[]00 Ver.1.67.00; through NJ501-1[]00 Ver.1.67.02; through NJ501-1[]20 Ver.1.68.01; through NJ501-1340 Ver.1.67.00; through NJ501-4[][][] Ver.1.67.00
• OMRON Corporation Machine Automation Controller NX-series: through NX102-[][][][] Ver.1.68.01; through NX1P2-[][][][][][] Ver.1.64.09; through NX1P2-[][][][][][]1 Ver.1.64.09; through NX502-[][][][] Ver.1.68.01; through NX701-[][][][] Ver.1.35.09
• OMRON Corporation Sysmac Studio Software: SYSMAC-SE2[][][] all

References

• https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-004_en.pdf
• https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-004_ja.pdf

Get alerted when CVE-2025-1384 or the next vulnerability affects your stack