OMRON Corporation's vulnerability footprint spans industrial automation and control software, a critical infrastructure domain where its products serve manufacturing, energy, and process-control environments. The vendor's disclosures, concentrated in engineering tools such as CX-Programmer, CX-Supervisor, and the CX-One integrated platform, skew toward serious outcomes with an elevated share reaching critical severity. The recurring weakness classes—out-of-bounds writes, use-after-free conditions, stack-based buffer overflows, and type-confusion flaws—reflect memory-safety and resource-handling challenges endemic to native industrial software, where legacy codebases and real-time constraints intersect. Defenders managing these control systems should treat OMRON advisories as high-priority within the OT environment and prioritize patches for engineering workstations and supervisory access points; live severity and exploitation counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by OMRON Corporation over time
Of all the CVEs published by OMRON Corporation as a CNA, 0.0% affect products that OMRON Corporation develops as a vendor.
Of all the CVEs published that affect products developed by OMRON Corporation, 0.0% are self-published by OMRON Corporation as a CNA.
Signals from CVEs in this vendor scope (89 CVEs).
89 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2000-0704HIGH Buffer overflow in SGI Omron WorldView Wnn allows remote attackers to execute arbitrary commands via long JS_OPEN, JS_MKDIR, or JS_FILE_INFO commands. | Oct 20, 2000 | 10.0 | 41 | NO | YES |
CVE-2022-3398CRITICAL OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | Oct 6, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-3396CRITICAL OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | Oct 6, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-31207CRITICAL The Omron SYSMAC Cx product family PLCs (CS series, CJ series, and CP series) through 2022-05-18 lack cryptographic authentication. They utilize the Omron FINS (9600/TCP) protocol | Jul 26, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-3397CRITICAL OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | Oct 6, 2022 | 9.8 | 29 | NO | NO |
CVE-2022-21137HIGH Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code. | Jan 14, 2022 | 7.8 | 29 | NO | NO |
CVE-2021-27413HIGH Omron CX-One Versions 4.60 and prior, including CX-Server Versions 5.0.29.0 and prior, are vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbit | May 13, 2021 | 7.8 | 29 | NO | NO |
CVE-2020-27261HIGH The Omron CX-One Version 4.60 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. | Feb 9, 2021 | 8.8 | 29 | NO | NO |
CVE-2019-18269CRITICAL Omron’s CS and CJ series PLCs have an unrestricted externally accessible lock vulnerability. | Dec 16, 2019 | 9.8 | 29 | NO | NO |
CVE-2019-18261CRITICAL In Omron PLC CS series, all versions, Omron PLC CJ series, all versions, and Omron PLC NJ series, all versions, the software does not implement sufficient measures to prevent multi | Dec 16, 2019 | 9.8 | 29 | NO | NO |
Signals from CVEs in this vendor scope (89 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by OMRON Corporation.
Media articles that mention a CVE ID that affects a product developed by OMRON Corporation — matched by CVE ID, not by vendor name.