{"id":"CVE-2014-2369","aliases":["EUVD-2014-2406","GHSA-q256-f2r8-r85r"],"status":"published","title":"Omron NS Series HMI Cross-Site Request Forgery","description":"Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.","severity":{"version":"2.0","score":4.6,"vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00592,"percentile":0.48547,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2014-07-24T14:00:00Z","modified":"2026-06-17T00:06:29Z","products":[{"vendor":"omron","product":"ns10"},{"vendor":"omron","product":"ns10_hmi_terminal"},{"vendor":"omron","product":"ns12"},{"vendor":"omron","product":"ns12_hmi_terminal"},{"vendor":"omron","product":"ns15"},{"vendor":"omron","product":"ns15_hmi_terminal"},{"vendor":"omron","product":"ns5"},{"vendor":"omron","product":"ns5_hmi_terminal"},{"vendor":"omron","product":"ns8"},{"vendor":"omron","product":"ns8_hmi_terminal"},{"vendor":"omron","product":"ns_series_system_program_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"},{"url":"https://automation.omron.com/en/us/products/"},{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2369"},{"url":"https://automation.omron.com/en/us/products"},{"url":"https://github.com/advisories/GHSA-q256-f2r8-r85r"}],"sources":{"cve":[{"id":"CVE-2014-2369","title":"Omron NS Series HMI Cross-Site Request Forgery","description":"Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.","status":"published","published":"2014-07-24T14:00:00Z","modified":"2025-10-06T17:59:20.171Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-2406","description":"Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.","status":"published","published":"2014-07-24T14:00:00Z","modified":"2025-10-06T17:59:20Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","level":"medium"}],"updated_at":"2026-11-02T20:31:35.828093Z"}],"ghsa":[{"id":"GHSA-q256-f2r8-r85r","title":"Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10,...","description":"Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.","status":"published","published":"2022-05-17T04:38:57Z","modified":"2025-10-06T18:32:08Z","cwes":["CWE-352"],"updated_at":"2026-11-02T15:03:52.40546Z"}],"nvd":[{"id":"CVE-2014-2369","description":"Cross-site request forgery (CSRF) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.","status":"published","published":"2014-07-24T14:55:07.287Z","modified":"2026-06-17T00:06:29.597Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","level":"medium","assessor":"secondary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:02:55.19899Z"}]}}