CVE-2024-27121

State: Published
Severity: 7.2 High
Published: Mar 12, 2024
Updated: Aug 16, 2024
Reserved: Feb 20, 2024

Description

Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request sent from a remote attacker with an administrative privilege. As for the details of the affected product names/versions, see the information provided by the vendor under [References] section.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
Machine Automation Controller NJ SeriesOMRON Corporation	NJ101-[][][][] Ver.1.64.03 and earlier Affected
Machine Automation Controller NJ SeriesOMRON Corporation	NJ301-[][][][] Ver.1.64.00 and earlier Affected
Machine Automation Controller NJ SeriesOMRON Corporation	NJ501-1[]0[] Ver.1.64.03 and earlier Affected
Machine Automation Controller NJ SeriesOMRON Corporation	NJ501-1[]2[] Ver.1.64.00 and earlier Affected
Machine Automation Controller NJ SeriesOMRON Corporation	NJ501-1340 Ver.1.64.00 and earlier Affected
Machine Automation Controller NJ SeriesOMRON Corporation	NJ501-4[][][] Ver.1.64.00 and earlier Affected
Machine Automation Controller NJ SeriesOMRON Corporation	NJ501-5300 Ver.1.64.00 and earlier Affected
Machine Automation Controller NJ SeriesOMRON Corporation	NJ501-R[][][] Ver.1.64.00 and earlier Affected
Machine Automation Controller NX SeriesOMRON Corporation	NX1P2-[][][][][][] Ver.1.64.00 and earlier Affected
Machine Automation Controller NX SeriesOMRON Corporation	NX1P2-[][][][][][]1 Ver.1.64.00 and earlier Affected
Machine Automation Controller NX SeriesOMRON Corporation	NX102-[][][][] Ver.1.64.00 and earlier Affected
Machine Automation Controller NX SeriesOMRON Corporation	NX502-[][][][] Ver.1.65.01 and earlier Affected
Machine Automation Controller NX SeriesOMRON Corporation	NX701-[][][][] Ver.1.35.00 and earlier Affected
Machine Automation Controller NX SeriesOMRON Corporation	NX-EIP201 Ver.1.00.01 and earlier Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.