CVE-2014-2369

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Omron	NS15	>= 8.1xx, < 8.68x
Omron	NS12	>= 8.1xx, < 8.68x
Omron	NS10	>= 8.1xx, < 8.68x
Omron	NS8	>= 8.1xx, < 8.68x
Omron	NS5	>= 8.1xx, < 8.68x

References

https://automation.omron.com/en/us/products/
https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01
http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01Third Party Advisory, US Government Resource

Timeline

Published: Jul 24, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-23703.5Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x al CVE-2014-23737.5The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings vi CVE-2014-23747.5The AXN-NET Ethernet module accessory 3.04 for the Accuenergy Acuvim II allows remote attackers to discover passwords and modify settings vi CVE-2014-23759.0Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to read or write to arbitrar CVE-2014-23767.5SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attacke CVE-2014-23775.0Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames v CVE-2014-23787.6Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updat CVE-2014-23795.4Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote atta CVE-2014-23807.8Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows remote attackers to obt CVE-2014-23812.1Schneider Electric Wonderware Information Server (WIS) Portal 4.0 SP1 through 5.5 uses weak encryption, which allows local users to obtain s CVE-2014-23827.2The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of se CVE-2014-23836.8dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and re