High severity · published Jun 24, 2024
CVE-2024-33687
Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Nj-pa3001 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj-pd3001 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj101-1000 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj101-1020 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj101-9000 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj101-9020 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj301-1100 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj301-1200 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj501-1300 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj501-1320 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj501-1340 Firmware · Omron
All versions, or not specified · source: NVD
NF
Nj501-140 Firmware · Omron
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-33687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-33687
Third Party Advisory
https://jvn.jp/en/vu/JVNVU92504444/
Vendor Advisory
https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2024-004_en.pdf
More from Nj-pa3001 Firmware
8.1
CVE-2022-34151
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models…
8.1
CVE-2022-33208
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all…
7.5
CVE-2022-33971
Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all…