CVE-2024-33687 Security feature bypass in NJ Series CPU Unit

High 7.5 Published 24 Jun 2024 Updated 13 Mar 2025

Attackers can alter user programs on OMRON NJ and NX CPU Units without detection due to insufficient data authenticity verification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-33687?

CVE-2024-33687 is a high-severity vulnerability in OMRON Corporation NJ Series CPU Unit, published on 24 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insufficient verification of data authenticity issue exists in NJ Series CPU Unit all versions and NX Series CPU Unit all versions. If a user program in the affected product is altered, the product may not be able to detect the alteration.

Weakness: CWE-345

Which versions are affected by CVE-2024-33687?

It affects 55 products.

Products include Omron Nj-Pa3001 Firmware, Omron Nj-Pd3001 Firmware, Omron Nj101-1000 Firmware, Omron Nj101-1020 Firmware, Omron Nj101-9000 Firmware, Omron Nj101-9020 Firmware and 49 more.

How do I fix CVE-2024-33687?

No fix has been published for CVE-2024-33687 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-33687 being exploited?

There is no known exploitation of CVE-2024-33687 in the wild and no public exploit code.

CVE-2022-33971 Auth bypass in Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series High 8.3

Sources

Also known as GHSA-9vq2-24jp-74ch.