CVE-2024-12083

🎯 CVE-2024-12083 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2024-12083 | Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.

Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.

Klassifikation & Betroffenheit:

CWE-22 OMRON Corporation Machine Automation Controller NJ-series NJ101-[][][][] Ver.1.64.05 and lowerMachine Automation Controller NX-series NX1P2-[][][][][][]1 Ver.1.64.04 and lowerMachine Automation Controller NJ-series NJ501-4[][][] Ver.1.64.04 and lowerMachine Automation Controller NX-series NX502-[][][][] Ver.1.66.03 and lowerMachine Automation Controller NX-series NX-EIP201 Ver.1.01.02 and lowerMachine Automation Controller NJ-series NJ501-1[]0[] Ver.1.64.05 and lowerMachine Automation Controller NJ-series NJ501-R[][][] Ver.1.64.04 and lowerMachine Automation Controller NJ-series NJ501-1340 Ver.1.64.04 and lower

Improper Limitation of a Pathname to a Restricted Directory 🎯 High

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

🛡️ Empfohlene Mitigation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all …

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-64 · Using Slashes and URL Encoding Combined … (High) CAPEC-76 · Manipulating Web Input to File System Ca… (Very High) CAPEC-78 · Using Escaped Slashes in Alternate Encod… (High) CAPEC-79 · Using Slashes in Alternate Encoding (High) CAPEC-126 · Path Traversal (Very High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-19594 8.1 CVE-2026-33466 8.1 CVE-2024-37037 8.1 CVE-2024-36267 8.1 CVE-2023-44251 8.1

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2024

Veröffentlicht 01/2025

Heute 02.11.

CVSS-Vektor-Analyse: 6.6

AV · Angriffsvektor Netzwerk

AC · Komplexität Hoch

PR · Privilegien Hoch

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CNA-Bewertung (OMRON): 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:14.01.2025

Aktualisiert:06.05.2025 23:55

Assigner (CNA):OMRON

EUVD-ID:EUVD-2024-50579

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	753	0,2 %
≥50 %	3.316	0,9 %
≥10 %	22.070	5,7 %
<10 %	360.967	93,2 %

6.6 MEDIUM

EPSS

0.7%

CVE-2024-12083 🌐 Netzwerk (Remote) 🔐 Admin-Rechte nötig

OMRON Corporation

CVE-2024-12083 | Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.

CWE-22 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 1 Jahr ↻ vor 1 Jahr

🛡️ Details ➔

CVE-2024-12083 | Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.

Zero-Day & Vulnerability Intelligence Hub

CVE-2024-12083 | Path Traversal Vulnerabilities (CWE-22) exist in NJ/NX-series Machine Automation Controllers. An attacker may use these vulnerabilities to perform unauthorized access and to execute unauthorized code remotely to the controller products.