CVE-2022-34151
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine…
- Published
- Updated
- Reserved
- Assigned by
- jpcert
Description
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Critical9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.3% · top 30% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.
Weakness
- Use of Hard-coded Credentials
- CWE-798 Use of Hard-coded Credentials (opens in a new tab)All about CWE-798 and its CVEs
Affected products
OMRON Corporation · Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series
- affected Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier
References (2)
- https://www.ia.omron.com/product/vulnerability/OMSR-2022-001_en.pdf (opens in a new tab)x_refsource_MISCx_transferred
- https://jvn.jp/en/vu/JVNVU97050784/index.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-34151)Record last updated .