github - ghsa-xv4j-6mfg-j9p6

ghsa-xv4j-6mfg-j9p6

Vulnerability from github

Published

2025-02-17 00:31

Modified

2025-02-17 00:31

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-0591"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-125"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-17T00:15:08Z",
    "severity": "HIGH"
  },
  "details": "Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.",
  "id": "GHSA-xv4j-6mfg-j9p6",
  "modified": "2025-02-17T00:31:40Z",
  "published": "2025-02-17T00:31:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0591"
    },
    {
      "type": "WEB",
      "url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-003_en.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-003_ja.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-0591 (GCVE-0-2025-0591)

Vulnerability from cvelistv5

Published

2025-02-16 23:58

Modified

2025-02-18 16:06

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-125 - Out-of-bounds Read

Summary

Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.

References

URL

Tags

	https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-003_en.pdf
	https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-003_ja.pdf

Impacted products

	Vendor	Product	Version
	OMRON Corporation	FA Integrated Tool Package CX-One	Version: Ver.9.83 or lower

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0591",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-18T16:06:06.684155Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-18T16:06:14.940Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageName": "CX-Programmer",
          "product": "FA Integrated Tool Package CX-One",
          "vendor": "OMRON Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "Ver.9.83 or lower"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability."
            }
          ],
          "value": "Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-540",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-540 Overread Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-16T23:58:32.165Z",
        "orgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
        "shortName": "OMRON"
      },
      "references": [
        {
          "url": "https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2025-003_en.pdf"
        },
        {
          "url": "https://www.fa.omron.co.jp/product/security/assets/pdf/ja/OMSR-2025-003_ja.pdf"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update your CX-Programmer to the countermeasure version to fix the vulnerability.\u003cbr\u003eFor information on how to obtain and update the countermeasure version of the product, please contact our sales representative or distributor. You can update CX-One to the latest versions using the installed Omron Automation Software AutoUpdate tool.\u003cbr\u003e"
            }
          ],
          "value": "Update your CX-Programmer to the countermeasure version to fix the vulnerability.\nFor information on how to obtain and update the countermeasure version of the product, please contact our sales representative or distributor. You can update CX-One to the latest versions using the installed Omron Automation Software AutoUpdate tool."
        }
      ],
      "source": {
        "advisory": "OMSR-2025-003",
        "discovery": "UNKNOWN"
      },
      "title": "Out-of-bounds Read vulnerability in CX-Programmer",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\u003cbr\u003e\u003cbr\u003e1. Anti-virus protection Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\u003cbr\u003e\u003cbr\u003e2. Security measures to prevent unauthorized access\u003cbr\u003e- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\u003cbr\u003e- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\u003cbr\u003e- Use a virtual private network (VPN) for remote access to control systems and equipment.\u003cbr\u003e- Use strong passwords and change them frequently.\u003cbr\u003e- Install physical controls so that only authorized personnel can access control systems and equipment.\u003cbr\u003e- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\u003cbr\u003e- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\u003cbr\u003e\u003cbr\u003e3. Data input and output protection Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\u003cbr\u003e\u003cbr\u003e4. Data recovery Periodical data backup and maintenance to prepare for data loss.\u003cbr\u003e"
            }
          ],
          "value": "OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities.\n\n1. Anti-virus protection Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection.\n\n2. Security measures to prevent unauthorized access\n- Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them.\n- Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network.\n- Use a virtual private network (VPN) for remote access to control systems and equipment.\n- Use strong passwords and change them frequently.\n- Install physical controls so that only authorized personnel can access control systems and equipment.\n- Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices.\n- Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible.\n\n3. Data input and output protection Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices.\n\n4. Data recovery Periodical data backup and maintenance to prepare for data loss."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bba440f9-ef23-4224-aa62-7ac0935d18d1",
    "assignerShortName": "OMRON",
    "cveId": "CVE-2025-0591",
    "datePublished": "2025-02-16T23:58:32.165Z",
    "dateReserved": "2025-01-20T06:13:11.242Z",
    "dateUpdated": "2025-02-18T16:06:14.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.