High severity · published Mar 12, 2024
CVE-2024-27121
Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series
7.2
CVSS
0.9%
EPSS
No
On KEV
Description
Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request sent from a remote attacker with an administrative privilege. As for the details of the affected product names/versions, see the information provided by the vendor under [References] section.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Machine Automation Controller NJ Series · OMRON Corporation
NJ101-[][][][] Ver.1.64.03 and earlier ; NJ301-[][][][] Ver.1.64.00 and earlier ; NJ501-1[]0[] Ver.1.64.03 and earlier ; NJ501-1[]2[] Ver.1.64.00 and earlier ; NJ501-1340 Ver.1.64.00 and earlier ; NJ501-4[][][] Ver.1.64.00 and earlier ; +2 more · source: vendor
MA
Machine Automation Controller NX Series · OMRON Corporation
NX1P2-[][][][][][] Ver.1.64.00 and earlier ; NX1P2-[][][][][][]1 Ver.1.64.00 and earlier ; NX102-[][][][] Ver.1.64.00 and earlier ; NX502-[][][][] Ver.1.65.01 and earlier ; NX701-[][][][] Ver.1.35.00 and earlier ; NX-EIP201 Ver.1.00.01 and earlier · source: vendor
NF
Nj101-9020 Firmware · Omron
through 1.64.03 · source: CISA
NF
Nj301-1200 Firmware · Omron
through 1.64.00 · source: CISA
NF
Nj501-r520 Firmware · Omron
through 1.64.00 · source: CISA
Affected product
MA
Machine Automation Controller NJ Series
OMRON Corporation
More from Machine Automation Controller NJ Series
7.0
CVE-2025-1384
Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers
6.6
CVE-2024-12083
Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers