VulnerabilityDeferred

CVE-2025-1384

Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software.

HIGH 7.0EPSS 0.23%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software. An attacker may use this vulnerability to perform unauthorized access and to execute unauthorized code remotely to the controller products.

CVSS 3.1: 7.0 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-272
Source: bba440f9-ef23-4224-aa62-7ac0935d18d1

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.