Omron NS Series HMI Cross-Site Request Forgery

Description

Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Scores

EPSS (exploitation in 30 days)

0.59% · top 52% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.6.

Weakness

• CWE-352 (opens in a new tab)All about CWE-352 and its CVEs

Affected products

• Omron · NS15

  • affected 8.1xx – < 8.68x

• Omron · NS12

  • affected 8.1xx – < 8.68x

• Omron · NS10

  • affected 8.1xx – < 8.68x

• Omron · NS8

  • affected 8.1xx – < 8.68x

• Omron · NS5

  • affected 8.1xx – < 8.68x

What to do

Solution: Omron Corporation has produced update, Version 8.69x for Japan and Version 8.7x for other countries, that mitigates the identified vulnerabilities. The updates for the NS series of HMI terminals can be downloaded at the following locations: NS15 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html NS12 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html NS10 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html NS8 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html NS5 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html

References (3)

• https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01 (opens in a new tab)
• https://automation.omron.com/en/us/products/ (opens in a new tab)
• http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2014-2369](https://trackcve.app/badge/CVE-2014-2369.svg)](https://trackcve.app/cve/CVE-2014-2369)

Record last updated 6 Oct 2025, 17:59 UTC.