Vulnerabilites related to omron - ns12
var-201407-0239
Vulnerability from variot
Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron's touch screen HMI programming software. There is an HTML injection vulnerability in Omron NS series HMI Terminals. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. The following products and versions are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals 8.1xx to 8.68x versions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0239",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ns series system program",
"scope": "eq",
"trust": 2.2,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns series system program",
"scope": "eq",
"trust": 2.2,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns8 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns10 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns15 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns5 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns12 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns10",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns12",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns15",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns5",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns8",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns series software",
"scope": "eq",
"trust": 0.8,
"vendor": "omron",
"version": "8.1xx to 8.68x"
},
{
"model": "ns15 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns12 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns10 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns8 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns5 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns series system program",
"version": "8.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns series system program",
"version": "8.68"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns10 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns12 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns15 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns5 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "ns8 hmi terminal",
"version": null
},
{
"model": "ns8",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns8",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns5",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns5",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns15",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns15",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns12",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns12",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns10",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns10",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns8",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns5",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns15",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns12",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns10",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
}
],
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:omron_2:ns10_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:omron_2:ns12_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:omron_2:ns15_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:omron_2:ns5_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:omron_2:ns8_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:omron_2:ns_series_system_program_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Sevilleja Febrer of S2 Grupo",
"sources": [
{
"db": "BID",
"id": "68836"
}
],
"trust": 0.3
},
"cve": "CVE-2014-2370",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CVE-2014-2370",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CNVD-2014-04730",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "VHN-70309",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:S/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-2370",
"trust": 1.0,
"value": "LOW"
},
{
"author": "NVD",
"id": "CVE-2014-2370",
"trust": 0.8,
"value": "Low"
},
{
"author": "CNVD",
"id": "CNVD-2014-04730",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-596",
"trust": 0.6,
"value": "LOW"
},
{
"author": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1",
"trust": 0.2,
"value": "LOW"
},
{
"author": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "LOW"
},
{
"author": "VULHUB",
"id": "VHN-70309",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron\u0027s touch screen HMI programming software. There is an HTML injection vulnerability in Omron NS series HMI Terminals. \nSuccessful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. The following products and versions are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals 8.1xx to 8.68x versions",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2370"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-70309"
}
],
"trust": 2.88
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-2370",
"trust": 3.8
},
{
"db": "ICS CERT",
"id": "ICSA-14-203-01",
"trust": 3.4
},
{
"db": "BID",
"id": "68836",
"trust": 2.0
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2014-04730",
"trust": 1.0
},
{
"db": "JVN",
"id": "JVNVU97798872",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554",
"trust": 0.8
},
{
"db": "IVD",
"id": "7D7DEF40-463F-11E9-B4A6-000C29342CB1",
"trust": 0.2
},
{
"db": "IVD",
"id": "E2E3071C-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-70309",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"id": "VAR-201407-0239",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
}
],
"trust": 1.8361111166666668
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.0
}
],
"sources": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
}
]
},
"last_update_date": "2024-11-23T21:45:02.195000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Scalable HMI",
"trust": 0.8,
"url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/default.html"
},
{
"title": "NS5, NS8, NS10, NS12, NS15, NSH5-V2",
"trust": 0.8,
"url": "http://www.fa.omron.co.jp/products/family/155/download/catalog.html"
},
{
"title": "Omron NS series HMI Terminals HTML Injection Vulnerability Patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/48043"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-203-01"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/bid/68836"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2370"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu97798872/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2370"
},
{
"trust": 0.3,
"url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"db": "VULHUB",
"id": "VHN-70309"
},
{
"db": "BID",
"id": "68836"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
},
{
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-31T00:00:00",
"db": "IVD",
"id": "7d7def40-463f-11e9-b4a6-000c29342cb1"
},
{
"date": "2014-07-31T00:00:00",
"db": "IVD",
"id": "e2e3071c-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-07-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"date": "2014-07-24T00:00:00",
"db": "VULHUB",
"id": "VHN-70309"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68836"
},
{
"date": "2014-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"date": "2014-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-596"
},
{
"date": "2014-07-24T14:55:07.317000",
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04730"
},
{
"date": "2015-10-08T00:00:00",
"db": "VULHUB",
"id": "VHN-70309"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68836"
},
{
"date": "2014-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003554"
},
{
"date": "2014-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-596"
},
{
"date": "2024-11-21T02:06:09.977000",
"db": "NVD",
"id": "CVE-2014-2370"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Omron NS Series HMI Terminal Web Application cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003554"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-596"
}
],
"trust": 0.6
}
}
var-201407-0238
Vulnerability from variot
Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron's touch screen HMI programming software. Allows remote attackers to perform unauthorized operations with specially crafted data. This may lead to further attacks. The following products are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals versions 8.1xx to 8.68x
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0238",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ns series system program",
"scope": "eq",
"trust": 2.2,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns series system program",
"scope": "eq",
"trust": 2.2,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns8 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns10 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns15 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns5 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns12 hmi terminal",
"scope": "eq",
"trust": 1.0,
"vendor": "omron",
"version": null
},
{
"model": "ns10",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns12",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns15",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns5",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns8",
"scope": null,
"trust": 0.8,
"vendor": "omron",
"version": null
},
{
"model": "ns series software",
"scope": "eq",
"trust": 0.8,
"vendor": "omron",
"version": "8.1xx to 8.68x"
},
{
"model": "ns15 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns12 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns10 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns8 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns5 hmi terminal",
"scope": null,
"trust": 0.6,
"vendor": "omron",
"version": null
},
{
"model": "ns8",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns8",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns5",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns5",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns15",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns15",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns12",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns12",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns10",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.68"
},
{
"model": "ns10",
"scope": "eq",
"trust": 0.3,
"vendor": "omron",
"version": "8.1"
},
{
"model": "ns8",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns5",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns15",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns12",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": "ns10",
"scope": "ne",
"trust": 0.3,
"vendor": "omron",
"version": "8.7"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns series system program",
"version": "8.1"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns series system program",
"version": "8.68"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns10 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns12 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns15 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns5 hmi terminal",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "ns8 hmi terminal",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:omron_2:ns10_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:omron_2:ns12_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:omron_2:ns15_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:omron_2:ns5_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:omron_2:ns8_hmi_terminal",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:omron_2:ns_series_system_program_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Joel Sevilleja Febrer of S2 Grupo",
"sources": [
{
"db": "BID",
"id": "68834"
}
],
"trust": 0.3
},
"cve": "CVE-2014-2369",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "CVE-2014-2369",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "CNVD-2014-04727",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 6.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.8,
"id": "VHN-70308",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:S/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-2369",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-2369",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2014-04727",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201407-595",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-70308",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. Omron NS5, NS8, NS10, NS12 and NS15 HMI Terminals are Omron\u0027s touch screen HMI programming software. Allows remote attackers to perform unauthorized operations with specially crafted data. This may lead to further attacks. The following products are affected: Omron NS5, NS8, NS10, NS12, NS15 HMI Terminals versions 8.1xx to 8.68x",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-2369"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "VULHUB",
"id": "VHN-70308"
}
],
"trust": 2.7
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-2369",
"trust": 3.6
},
{
"db": "ICS CERT",
"id": "ICSA-14-203-01",
"trust": 3.4
},
{
"db": "BID",
"id": "68834",
"trust": 1.0
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2014-04727",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU97798872",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553",
"trust": 0.8
},
{
"db": "IVD",
"id": "E2E5FEF4-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-70308",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"id": "VAR-201407-0238",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
}
],
"trust": 1.6361111166666666
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
}
]
},
"last_update_date": "2024-11-23T21:45:02.239000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Scalable HMI",
"trust": 0.8,
"url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/default.html"
},
{
"title": "NS5, NS8, NS10, NS12, NS15, NSH5-V2",
"trust": 0.8,
"url": "http://www.fa.omron.co.jp/products/family/155/download/catalog.html"
},
{
"title": "Patch for Omron NS series HMI Terminals Cross-Site Request Forgery Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/48034"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.4,
"url": "http://ics-cert.us-cert.gov/advisories/icsa-14-203-01"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-2369"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu97798872/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-2369"
},
{
"trust": 0.3,
"url": "http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"db": "VULHUB",
"id": "VHN-70308"
},
{
"db": "BID",
"id": "68834"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
},
{
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-31T00:00:00",
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-07-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"date": "2014-07-24T00:00:00",
"db": "VULHUB",
"id": "VHN-70308"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68834"
},
{
"date": "2014-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"date": "2014-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-595"
},
{
"date": "2014-07-24T14:55:07.287000",
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-04727"
},
{
"date": "2014-07-24T00:00:00",
"db": "VULHUB",
"id": "VHN-70308"
},
{
"date": "2014-07-22T00:00:00",
"db": "BID",
"id": "68834"
},
{
"date": "2014-07-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003553"
},
{
"date": "2014-07-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201407-595"
},
{
"date": "2024-11-21T02:06:09.870000",
"db": "NVD",
"id": "CVE-2014-2369"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Omron NS series HMI Terminals Cross-Site Request Forgery Vulnerability",
"sources": [
{
"db": "IVD",
"id": "e2e5fef4-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-04727"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201407-595"
}
],
"trust": 0.6
}
}
CVE-2018-6624 (GCVE-0-2018-6624)
Vulnerability from cvelistv5
Published
2018-02-05 18:00
Modified
2024-08-05 06:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html.
References
| ▼ | URL | Tags |
|---|---|---|
| http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:10:10.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-02-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-02-05T17:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-6624",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html",
"refsource": "MISC",
"url": "http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-6624",
"datePublished": "2018-02-05T18:00:00",
"dateReserved": "2018-02-05T00:00:00",
"dateUpdated": "2024-08-05T06:10:10.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2369 (GCVE-0-2014-2369)
Vulnerability from cvelistv5
Published
2014-07-24 14:00
Modified
2025-10-06 17:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.244Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NS15",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS12",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS10",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS8",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS5",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joel Sevilleja Febrer of S2 Grupo"
}
],
"datePublic": "2014-07-22T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.\u003c/p\u003e"
}
],
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T17:59:20.171Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
},
{
"url": "https://automation.omron.com/en/us/products/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOmron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\u003c/p\u003e\n\u003cp\u003eNS15 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS12 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS10 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS8 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS5 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Omron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\n\n\nNS15 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html \n\nNS12 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html \n\nNS10 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html \n\nNS8 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html \n\nNS5 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html"
}
],
"source": {
"advisory": "ICSA-14-203-01",
"discovery": "UNKNOWN"
},
"title": "Omron NS Series HMI Cross-Site Request Forgery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2369",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2369",
"datePublished": "2014-07-24T14:00:00",
"dateReserved": "2014-03-13T00:00:00",
"dateUpdated": "2025-10-06T17:59:20.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-2370 (GCVE-0-2014-2370)
Vulnerability from cvelistv5
Published
2014-07-24 14:00
Modified
2025-10-06 18:01
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
References
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T10:14:25.880Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
},
{
"name": "68836",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/68836"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "NS15",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS12",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS10",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS8",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NS5",
"vendor": "Omron",
"versions": [
{
"lessThan": "8.68x",
"status": "affected",
"version": "8.1xx",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joel Sevilleja Febrer of S2 Grupo"
}
],
"datePublic": "2014-07-22T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\nCross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.\n\n\u003c/p\u003e"
}
],
"value": "Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data."
}
],
"metrics": [
{
"cvssV2_0": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T18:01:21.608Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"
},
{
"url": "https://automation.omron.com/en/us/products/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOmron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\u003c/p\u003e\n\u003cp\u003eNS15 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS12 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS10 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS8 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html\u003c/a\u003e\u003c/p\u003e\u003cp\u003eNS5 Software Update Version 8.7:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\"\u003ehttp://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
}
],
"value": "Omron Corporation has produced update, Version 8.69x for Japan and \nVersion 8.7x for other countries, that mitigates the identified \nvulnerabilities. The updates for the NS series of HMI terminals can be \ndownloaded at the following locations:\n\n\nNS15 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html \n\nNS12 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html \n\nNS10 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html \n\nNS8 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html \n\nNS5 Software Update Version 8.7:\n\n\n http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html"
}
],
"source": {
"advisory": "ICSA-14-203-01",
"discovery": "EXTERNAL"
},
"title": "Omron NS Series HMI Improper Neutralization of Input During Web Page Generation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2014-2369",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01",
"refsource": "MISC",
"url": "http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2014-2370",
"datePublished": "2014-07-24T14:00:00",
"dateReserved": "2014-03-13T00:00:00",
"dateUpdated": "2025-10-06T18:01:21.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2018-02-05 18:29
Modified
2024-11-21 04:11
Severity ?
Summary
OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html | Third Party Advisory |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:omron:ns_series_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1EF95403-DE01-4ABF-B877-6EC88268FCDC",
"versionEndIncluding": "1.3",
"versionStartIncluding": "1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:omron:ns10:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1D65A565-79CF-48F7-89AA-B25D4126BC30",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:omron:ns12:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D5C66177-8822-4330-AB4E-0D18C06B4889",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:omron:ns15:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1ADD9BA5-F03C-4B69-A088-A46C08C90DC4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:omron:ns5:-:*:*:*:*:*:*:*",
"matchCriteriaId": "095B49B3-A9A3-448A-B07B-7921285920B7",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:omron:ns8:-:*:*:*:*:*:*:*",
"matchCriteriaId": "360BDC8D-811F-4F63-9FFC-A81C6617D376",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:omron:nsh5:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F131D0DE-3CD9-4EFF-9D0E-8B6A896DEA9F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html."
},
{
"lang": "es",
"value": "Los dispositivos OMRON NS desde la versi\u00f3n 1.1 hasta la 1.3 permite que los atacantes remotos omitan la autenticaci\u00f3n mediante una petici\u00f3n directa al archivo .html para una pantalla espec\u00edfica, tal y como queda demostrado en monitor.html."
}
],
"id": "CVE-2018-6624",
"lastModified": "2024-11-21T04:11:00.960",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-02-05T18:29:00.390",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://misteralfa-hack.blogspot.cl/2018/02/otomron-login-bypass.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-425"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}