CVE-2015-0987 in CX-One CX-Programmer
Summary
by MITRE
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 06/03/2026
The vulnerability described in CVE-2015-0987 represents a critical security flaw in Omron's industrial control systems, specifically affecting their CX-One software suite and CJ2M and CJ2H PLC devices. This weakness stems from the implementation of cleartext password transmission during PLC unlock operations, creating an exploitable vector for unauthorized access to industrial automation systems. The vulnerability impacts a significant portion of Omron's industrial control infrastructure, particularly versions prior to 9.6 for CX-Programmer software and specific firmware versions for the CJ2M and CJ2H PLC families.
The technical flaw manifests in the network communication protocols used by these industrial devices, where authentication credentials are transmitted without encryption or proper security measures. When a user attempts to unlock a PLC device through the CX-Programmer interface, the system sends password information in plaintext format across the network, making it susceptible to interception by malicious actors. This cleartext transmission violates fundamental security principles for industrial control systems and creates a pathway for attackers to gain unauthorized access to critical manufacturing and process control environments. The vulnerability specifically affects the authentication phase of PLC operations, where the system requests unlock permissions from the device, making it particularly dangerous as it can lead to complete system compromise.
The operational impact of this vulnerability extends beyond simple credential theft, as it enables attackers to gain unauthorized access to industrial control systems that manage critical infrastructure operations. Remote attackers who can intercept network traffic can obtain sensitive information including passwords, system configurations, and operational parameters that may reveal critical details about production processes, security measures, and system architecture. This information can be leveraged for further attacks including system manipulation, process disruption, or data exfiltration, potentially causing significant operational downtime and financial losses. The vulnerability particularly affects manufacturing environments where PLC systems control production lines, safety systems, and process automation, making it a serious concern for industrial cybersecurity.
Organizations should implement immediate mitigations including network segmentation to isolate PLC communications from general network traffic, deployment of network monitoring tools to detect and prevent cleartext credential transmission, and implementation of secure remote access solutions with proper encryption. The recommended approach involves upgrading to supported versions of CX-Programmer software and PLC firmware that address this vulnerability through proper authentication mechanisms and encrypted communication protocols. Additionally, organizations should conduct thorough network security assessments to identify any instances of cleartext transmission and implement network access controls to limit exposure. This vulnerability aligns with CWE-312 (Cleartext Storage of Sensitive Information) and represents a significant concern for compliance with industrial security standards such as NIST SP 800-82 and IEC 62443. The attack surface for this vulnerability is particularly concerning given that industrial environments often lack robust network security monitoring capabilities, making such cleartext transmission attacks more easily exploitable. Organizations should also consider implementing zero-trust network architectures for industrial control systems and establish secure remote access policies that prevent unauthorized network access to critical industrial devices.