CVE-2022-34151
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all...
CVE-2022-34151 is a high vulnerability (CVSS 8.1) in Omron Sysmac Studio, published July 4, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.29%, the 70th percentile. No source names a fixed version.
- Severity
- 8.1 HighCVSS 3.1, NVD
- Exploit chance
- 1.29%EPSS, 70th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
- omron sysmac studio
- omron na5-12w firmware
- omron na5-15w firmware
- omron na5-7w firmware
- omron na5-9w firmware
- omron nj-pa3001 firmware
- omron nj-pd3001 firmware
- omron nj101-1000 firmware
- omron nj101-1020 firmware
- omron nj101-9000 firmware
- omron nj101-9020 firmware
- omron nj301-1100 firmware
Show 46 moreShow less
- omron nj301-1200 firmware
- omron nj501-1300 firmware
- omron nj501-1320 firmware
- omron nj501-1340 firmware
- omron nj501-140 firmware
- omron nj501-1420 firmware
- omron nj501-1500 firmware
- omron nj501-1520 firmware
- omron nj501-4300 firmware
- omron nj501-4310 firmware
- omron nj501-4320 firmware
- omron nj501-4400 firmware
- omron nj501-4500 firmware
- omron nj501-5300 firmware
- omron nj501-r300 firmware
- omron nj501-r320 firmware
- omron nj501-r400 firmware
- omron nj501-r420 firmware
- omron nj501-r500 firmware
- omron nj501-r520 firmware
- omron nx102-1000 firmware
- omron nx102-1020 firmware
- omron nx102-1100 firmware
- omron nx102-1120 firmware
- omron nx102-1200 firmware
- omron nx102-1220 firmware
- omron nx102-9020 firmware
- omron nx1p2-1040dt1 firmware
- omron nx1p2-1040dt firmware
- omron nx1p2-1140dt1 firmware
- omron nx1p2-1140dt firmware
- omron nx1p2-9024dt1 firmware
- omron nx1p2-9024dt firmware
- omron nx1w-adb21 firmware
- omron nx1w-cif01 firmware
- omron nx1w-cif11 firmware
- omron nx1w-cif12 firmware
- omron nx1w-dab21v firmware
- omron nx1w-mab221 firmware
- omron nx701-1600 firmware
- omron nx701-1620 firmware
- omron nx701-1700 firmware
- omron nx701-1720 firmware
- omron nx701-z600 firmware
- omron nx701-z700 firmware
- omron corporation machine automation controller nj series, machine automation controller nx series, automation software 'sysmac studio', and programmable terminal (pt) na series
What each source reports
NVD Score used
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
- Record
CVE-2022-34151- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-798
- Updated
- 2026-11-02
CVE List
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
- Record
CVE-2022-34151- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-798
- Updated
- 2026-11-02
EUVDEUVD-2022-37166
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
- Record
EUVD-2022-37166- CVSS 3.1
- 9.4 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gx2r-v5m4-v5qp
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all...
Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller.
- Record
GHSA-gx2r-v5m4-v5qp- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-294, CWE-798
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.