CVE-2014-2370: Omron NS Series HMI Improper Neutralization of Input During Web Page Generation

Published Jul 24, 2014

Updated

Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.

Affected Software

14 affected components

Omron Ns Series System Program Firmware=8.1

Omron Ns Series System Program Firmware=8.68

Omron Ns10 Hmi Terminal

Omron Ns12 Hmi Terminal

Omron NS15 HMI terminal

Omron Ns5 Hmi Terminal

Omron Ns8 Hmi Terminal

All of the following

Any of the following

Omron Ns Series System Program Firmware=8.1

Omron Ns Series System Program Firmware=8.68

Any of the following

Omron Ns10 Hmi Terminal

Omron Ns12 Hmi Terminal

Omron NS15 HMI terminal

Omron Ns5 Hmi Terminal

Omron Ns8 Hmi Terminal

Remediation

Information

Omron Corporation has produced update, Version 8.69x for Japan and Version 8.7x for other countries, that mitigates the identified vulnerabilities. The updates for the NS series of HMI terminals can be downloaded at the following locations: NS15 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns15/default.html NS12 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns12/default.html NS10 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns10/default.html NS8 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns8/default.html NS5 Software Update Version 8.7: http://industrial.omron.us/en/products/catalogue/automation_systems/hmi/scalable_hmi/ns5/default.html

Event History

Jul 24, 2014

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·02:55 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2370?

The severity of CVE-2014-2370 is classified as medium due to its potential impact on web application security.

How do I fix CVE-2014-2370?

To fix CVE-2014-2370, update the firmware of the affected Omron HMI terminals to the latest version available.

Which Omron products are affected by CVE-2014-2370?

CVE-2014-2370 affects Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals running firmware versions 8.1xx through 8.68x.

What type of vulnerability is CVE-2014-2370?

CVE-2014-2370 is a Cross-Site Scripting (XSS) vulnerability that allows authenticated users to inject scripts.

Can CVE-2014-2370 be exploited remotely?

Yes, CVE-2014-2370 can be exploited remotely by authenticated users through crafted data.