{"id":"CVE-2014-2370","aliases":["EUVD-2014-2407","GHSA-c4v2-5pvc-3vr9"],"status":"published","title":"Omron NS Series HMI Improper Neutralization of Input During Web Page Generation","description":"Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.01362,"percentile":0.7193,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2014-07-24T14:00:00Z","modified":"2026-06-17T00:06:29Z","products":[{"vendor":"omron","product":"ns10"},{"vendor":"omron","product":"ns10_hmi_terminal"},{"vendor":"omron","product":"ns12"},{"vendor":"omron","product":"ns12_hmi_terminal"},{"vendor":"omron","product":"ns15"},{"vendor":"omron","product":"ns15_hmi_terminal"},{"vendor":"omron","product":"ns5"},{"vendor":"omron","product":"ns5_hmi_terminal"},{"vendor":"omron","product":"ns8"},{"vendor":"omron","product":"ns8_hmi_terminal"},{"vendor":"omron","product":"ns_series_system_program_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-14-203-01"},{"url":"https://automation.omron.com/en/us/products/"},{"url":"http://ics-cert.us-cert.gov/advisories/ICSA-14-203-01","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/68836","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2370"},{"url":"https://automation.omron.com/en/us/products"},{"url":"https://github.com/advisories/GHSA-c4v2-5pvc-3vr9"}],"sources":{"cve":[{"id":"CVE-2014-2370","title":"Omron NS Series HMI Improper Neutralization of Input During Web Page Generation","description":"Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.","status":"published","published":"2014-07-24T14:00:00Z","modified":"2025-10-06T18:01:21.608Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2407","description":"Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.","status":"published","published":"2014-07-24T14:00:00Z","modified":"2025-10-06T18:01:21Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:35.828093Z"}],"ghsa":[{"id":"GHSA-c4v2-5pvc-3vr9","title":"Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12,...","description":"Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.","status":"published","published":"2022-05-17T04:04:56Z","modified":"2025-10-06T18:32:09Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:03:52.40546Z"}],"nvd":[{"id":"CVE-2014-2370","description":"Cross-site scripting (XSS) vulnerability in the web application on Omron NS5, NS8, NS10, NS12, and NS15 HMI terminals 8.1xx through 8.68x allows remote authenticated users to inject arbitrary web script or HTML via crafted data.","status":"published","published":"2014-07-24T14:55:07.317Z","modified":"2026-06-17T00:06:29.73Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:55.19899Z"}]}}