CVE-2022-34151
8.1 HIGHUse of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine auto...
Published: 2022-07-04 · Last updated: 2026-06-02
Severity and scoring
- CVSS
- 8.1 HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CWE
- CWE-798
Affected products
| Vendor | Product |
|---|---|
| omron | na5-12w_firmware, na5-15w_firmware, na5-7w_firmware |
Description
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2022-34151
- [Other]https://jvn.jp/en/vu/JVNVU97050784/index.html
- [Vendor advisory]https://www.ia.omron.com/product/vulnerability/OMSR-2022-001_en.pdf
- [Other]https://jvn.jp/en/vu/JVNVU97050784/index.html
- [Vendor advisory]https://www.ia.omron.com/product/vulnerability/OMSR-2022-001_en.pdf
Related CVEs
Same vendor
- CVE-2022-33971 — Authentication bypass by capture-replay vulnerability exists in Machine automation controller NX7 series all models V1.28 and earlier, Ma... (7.5 HIGH)
- CVE-2020-6986 — In all versions of Omron PLC CJ Series, an attacker can send a series of specific data packets within a short period, causing a service e... (7.5 HIGH)
- CVE-2019-18269 — Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability (9.8 CRITICAL)
- CVE-2019-13533 — In Omron PLC CJ series, all versions, and Omron PLC CS series, all versions, an attacker could monitor traffic between the PLC and the co... (8.1 HIGH)
- CVE-2015-0987 — Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmissi... (10.0 CRITICAL)
Same CWE
- CVE-2026-47281 — Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network (9.6 CRITICAL)
- CVE-2026-11414 — A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service
- CVE-2025-71317 — NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access (9.8 CRITICAL)
- CVE-2026-21404 — NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOAP) implementation (6.3 MEDIUM)
- CVE-2026-50213 — The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled by iterating predi... (7.5 HIGH)