In brief · As of October 2026
An Omron plant consists of NJ/NX controllers as EtherCAT master with NX I/O (NX-ECC couplers and NX units), 1S and G5 servos, NX safety units and vision sensors on EtherCAT, plus NA HMIs, NY IPCs and EtherNet/IP devices. From the maintenance PC, controller, CJ modules with EIP21 and IPCs answer ListIdentity with model, revision and serial number, the built-in port additionally via SNMP; the EtherCAT units are seen only by the master. They get into the device list via Sysmac Studio online (EtherCAT configuration with actual/planned comparison and unit version per slave) or via the controller, with model and unit version, the way Omron writes affected products in the advisory. Omron publishes as PDF with RSS, without [CSAF](/glossar/#csaf): 25 advisories, one update in 2026, machine-readable only via JVN and CISA. Omron hands out SBOMs only by agreement; for the plant you do not need one.
What hangs on an NJ/NX controller and what of it is visible on the network
The controller is an NJ or NX CPU (NX1P2, NX102, NJ501) with built-in EtherCAT master and EtherNet/IP port. On EtherCAT hang NX-ECC couplers with NX I/O units, NX-SL safety controllers with safety I/O, 1S and G5 servos, FH vision and third-party slaves; on EtherNet/IP NA HMIs, NY IPCs, CJ controllers with EIP21 module and third-party devices. With NX1P2, NX units additionally sit directly on the CPU.
- Visible via IP from the maintenance PC: NJ/NX CPUs, CJ1W/CS1W-EIP21 modules, NY IPCs and NA HMIs via EtherNet/IP ListIdentity (Vendor ID 47 = Omron, Product Code, Revision, serial number, product name), the built-in port of the NJ series additionally via SNMP (
sysDescr, sysObjectID). - Only via the master: all EtherCAT devices, i.e. NX-ECC couplers with their units, NX-SL with safety I/O, servos and vision. The CPU reads their identity from the EtherCAT slave information EEPROM; it knows the unit version from the configuration.
- Only from the engineering: NX units directly on an NX1P2 and the assignment of units to sub-plants; both are in the Sysmac Studio project.
How EtherCAT units and servos get into the list: Sysmac Studio and the controller
Sysmac Studio shows the EtherCAT configuration online with an actual/planned comparison: per slave model, revision, serial number and unit version, as read by the master. That is the route to the complete list of an Omron cell; the CPU itself provides the same data through its diagnostics. From the network, the following are added:
- Sysmac Studio: project with controller type, unit version and EtherCAT slave list – as planned, not as measured.
- EtherNet/IP Identity Object: NJ/NX controllers and CJ1W/CS1W-EIP21 modules answer ListIdentity (UDP 44818) with Vendor ID, Product Code, Revision, serial number and product name. This route covers the controller level.
- EtherCAT: NX I/O, G5/1S servos and safety terminals sit on the EtherCAT master of the NJ/NX and are only visible through it – from Sysmac Studio or via the controller.
- SNMP: the built-in EtherNet/IP port of the NJ series, CJ2 and EIP21 modules run an SNMP agent (
sysDescr, sysObjectID). Which query works where is covered in the article on the network scan.
How Omron publishes advisories and what matching runs on
Omron has run a PSIRT since 2023 and has been a CVE Numbering Authority since October 2024. The advisory list for industrial automation carries PDFs with an RSS feed; almost every entry refers to a JVN number (JPCERT), older ones to CISA ICSA advisories. There is no CSAF provider under omron.com, industrial.omron.eu or at CERT@VDE; Omron is not listed in the BSI aggregator.
| Measurement (7 Oct 2026) | Result |
|---|
| Advisories in the Omron IA list | 25 (2022: 2, 2023: 11, 2024: 7, 2025: 5) |
| 2026 new / updated | 0 / 1 (OMSR-2025-006 NY series IPC, 7 May 2026) |
| CISA OT feed: entries mentioning Omron in total / with 2026 activity | 30 / 0 |
| CSAF / CPE / PURL | none |
Affected products are listed in the PDF as series name with unit version and sometimes lot number (“NX1P2, Unit version 1.xx and earlier”). A structured identifier is missing; matching needs the series and unit version from the device list.
Without CSAF there is no product tree for automatic comparison. The practical route: monitor JVN entries and CISA ICS advisories on Omron by machine (CISA provides CSAF, albeit with a product tree without CPE) and read the Omron PDFs as the source for the unit version. The volume is manageable – only one update in 2026 so far – but that is exactly what tempts people not to look at all.
On the CRA, Omron explains its approach in a white paper (IEC 62443-4-1-certified development); whether and how customers will receive SBOMs in future is left open on the page.
Omron hands out SBOMs only by agreement and in its own format; for the plant you do not need one.
What this means for installations with Omron components
- Record series, model and unit version for each NJ/NX/CJ controller and each NY IPC – from the Identity Object and from Sysmac Studio.
- Take EtherCAT devices from the Sysmac project; the network scan does not reach them.
Watching three sources, reading PDFs, and half the cell hangs on EtherCAT where only the master looks. In Werkspilot Scan, Omron is stage 2 for controllers, IPCs and HMIs via ListIdentity and SNMP, and stage 3 for the EtherCAT units and servos behind them via the controller. We are currently trialling the third stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
