CVE-2025-0591Out-of-bounds Read vulnerability in CX-Programmer
- 7.8HighCVSS base score
- 0.18%Exploitation in 30 daysEPSS · top 93% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Out-of-bounds Read vulnerability (CWE-125) was found in CX-Programmer. Attackers may be able to read sensitive information or cause an application crash by abusing this vulnerability.
Timeline
ID reserved
By OMRON
- 27 days later
· 27 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| OMRONCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.18% · top 93% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
OMRON Corporation · FA Integrated Tool Package CX-One
- affected Ver.9.83 or lower
What to do
Solution: Update your CX-Programmer to the countermeasure version to fix the vulnerability. For information on how to obtain and update the countermeasure version of the product, please contact our sales representative or distributor. You can update CX-One to the latest versions using the installed Omron Automation Software AutoUpdate tool.
Workaround: OMRON recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities. 1. Anti-virus protection Protect any PC with access to the control system against malware and ensure installation and maintenance of up-to-date commercial grade anti-virus software protection. 2. Security measures to prevent unauthorized access - Minimize connection of control systems and equipment to open networks, so that untrusted devices will be unable to access them. - Implement firewalls (by shutting down unused communications ports, limiting communications hosts) and isolate them from the IT network. - Use a virtual private network (VPN) for remote access to control systems and equipment. - Use strong passwords and change them frequently. - Install physical controls so that only authorized personnel can access control systems and equipment. - Scan virus to ensure safety of any USB drives or similar devices before connecting them to systems and devices. - Enforce multifactor authentication to all devices with remote access to control systems and equipment whenever possible. 3. Data input and output protection Validation processing such as backup and range check to cope with unintentional modification of input/output data to control systems and devices. 4. Data recovery Periodical data backup and maintenance to prepare for data loss.
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-1786 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-0591)Record last updated .