What is the CVSS score of CVE-2015-0987?

CVE-2015-0987 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H. EPSS exploitation probability: 0.5%.

Omron CX-One CX-Programmer CVE-2015-0987

CRITICAL

Information Exposure (CWE-200)

2015-10-06 ics-cert@hq.dhs.gov

Information Disclosure

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

Severity Changed

Jun 02, 2026 - 21:22 NVD

MEDIUM CRITICAL

CVSS changed

Jun 02, 2026 - 21:22 NVD

5.0 (MEDIUM) 10.0 (CRITICAL)

CVE Published

Oct 06, 2015 - 01:59 cve.org

CRITICAL 10.0

DescriptionCVE.org

Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request.

AnalysisAI

Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Exposure of Sensitive Information (CWE-200), which allows attackers to access sensitive data that should not be disclosed. Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5 rely on cleartext password transmission, which allows remote attackers to obtain sensitive information by sniffing the network during a PLC unlock request. Affected products include: Omron Cx-Programmer, Omron Cj2H Plc, Omron Cj2M Plc. Version information: before 9.6.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Minimize information in error messages, implement proper access controls, encrypt sensitive data at rest and in transit.