CVE-2025-0591

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
OMRON Corporation	FA Integrated Tool Package CX-One	Ver.9.83 or lower

References

Timeline

Published: Feb 17, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-05928.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by manipulating the firmware file and uploadin CVE-2025-05938.8The vulnerability may allow a remote low priviledged attacker to run arbitrary shell commands by using lower-level functions to interact wit CVE-2025-05958.7A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPER CVE-2025-05965.4A stored Cross-site Scripting (XSS) vulnerability affecting Bookmark Editor in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIEN CVE-2025-05985.4A stored Cross-site Scripting (XSS) vulnerability affecting Relations in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R CVE-2025-05995.4A stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator on Release 3DEXPE CVE-2025-06005.4A stored Cross-site Scripting (XSS) vulnerability affecting Product Explorer in ENOVIA Collaborative Industry Innovator on Release 3DEXPERIE CVE-2025-06015.4A stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPER CVE-2025-06028.7A stored Cross-site Scripting (XSS) vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x thr CVE-2025-06039.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emerg CVE-2025-06045.4A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to CVE-2025-06054.3An issue has been discovered in GitLab CE/EE affecting all versions from 16.8 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1.