CVE-2024-27121 Path traversal in Machine Automation Controller NJ Series
Remote attackers with administrative privileges can access arbitrary files or execute code via path traversal in OMRON Machine Automation Controllers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27121?
CVE-2024-27121 is a high-severity path traversal vulnerability in OMRON Corporation Machine Automation Controller NJ Series , published on 12 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. An arbitrary file in the affected product may be accessed or arbitrary code may be executed by processing a specially crafted request sent from a remote attacker with an administrative privilege. As for the details of the affected product names/versions, see the information provided by the vendor under [References] section.
Weakness: CWE-22
Which versions are affected by CVE-2024-27121?
How do I fix CVE-2024-27121?
No fix has been published for CVE-2024-27121 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-27121 being exploited?
There is no known exploitation of CVE-2024-27121 in the wild and no public exploit code.
Sources
Also known as GHSA-m2f4-hwvj-h9rj.