Search criteria
6 vulnerabilities
CVE-2025-1863 (GCVE-0-2025-1863)
Vulnerability from cvelistv5 – Published: 2025-04-18 05:55 – Updated: 2025-04-18 12:00
VLAI?
Summary
Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings.
This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.
Severity ?
9.8 (Critical)
CWE
- CWE-1188 - Insecure Default Initialization of Resource
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Yokogawa Electric Corporation | GX10 / GX20 / GP10 / GP20 Paperless Recorders |
Affected:
R5.04.01 or earlier
(custom)
|
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-18T11:39:17.017969Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-18T12:00:37.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "GX10 / GX20 / GP10 / GP20 Paperless Recorders",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "R5.04.01 or earlier",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "GM Data Acquisition System",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "R5.05.01 or earlier",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DX1000 / DX2000 / DX1000N Paperless Recorders",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "R4.21 or earlier",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "FX1000 Paperless Recorders",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "R1.31 or earlier",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "\u03bcR10000 / \u03bcR20000 Chart Recorders",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "R1.51 or earlier",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "MW100 Data Acquisition Units",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "All versions",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "DX1000T / DX2000T Paperless Recorders",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "All versions",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CX1000 / CX2000 Paperless Recorders",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "All versions",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-04-17T18:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings.\u003cbr\u003e\u003cp\u003eThis issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; \u03bcR10000 / \u03bcR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.\u003c/p\u003e"
}
],
"value": "Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings.\nThis issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; \u03bcR10000 / \u03bcR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1188",
"description": "CWE-1188 Insecure Default Initialization of Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-18T05:55:26.303Z",
"orgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"shortName": "YokogawaGroup"
},
"references": [
{
"url": "https://web-material3.yokogawa.com/1/36974/files/YSAR-25-0001-E.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insecure default settings for recorder products",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"assignerShortName": "YokogawaGroup",
"cveId": "CVE-2025-1863",
"datePublished": "2025-04-18T05:55:26.303Z",
"dateReserved": "2025-03-03T05:46:48.396Z",
"dateUpdated": "2025-04-18T12:00:37.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8110 (GCVE-0-2024-8110)
Vulnerability from cvelistv5 – Published: 2024-09-17 02:04 – Updated: 2024-09-17 15:04
VLAI?
Summary
Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer.
If a computer on which the affected product is installed receives a large number of UDP broadcast packets in a short period, occasionally that computer may restart.
If both the active and standby computers are restarted at the same time, the functionality on that computer may be temporarily unavailable.
Severity ?
7.5 (High)
CWE
- CWE-252 - Unchecked Return Value
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Yokogawa Electric Corporation | Dual-redundant Platform for Computer (PC2CKM) |
Affected:
R1.01.00 , ≤ R2.03.00
(custom)
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:yokogawa:dual-redundant_platform_for_computer_\\(pc2ckm\\):*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "dual-redundant_platform_for_computer_\\(pc2ckm\\)",
"vendor": "yokogawa",
"versions": [
{
"lessThanOrEqual": "r2.03.00",
"status": "affected",
"version": "r1.01.00",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8110",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-17T14:57:26.649250Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T15:04:05.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Dual-redundant Platform for Computer (PC2CKM)",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"lessThanOrEqual": "R2.03.00",
"status": "affected",
"version": "R1.01.00",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-09-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer.\u003cbr\u003eIf a computer on which the affected product is installed receives a large number of UDP broadcast packets in a short period, occasionally that computer may restart.\u003cbr\u003eIf both the active and standby computers are restarted at the same time, the functionality on that computer may be temporarily unavailable."
}
],
"value": "Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer.\nIf a computer on which the affected product is installed receives a large number of UDP broadcast packets in a short period, occasionally that computer may restart.\nIf both the active and standby computers are restarted at the same time, the functionality on that computer may be temporarily unavailable."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252 Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-17T02:04:53.739Z",
"orgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"shortName": "YokogawaGroup"
},
"references": [
{
"url": "https://web-material3.yokogawa.com/1/36276/files/YSAR-24-0003-E.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"assignerShortName": "YokogawaGroup",
"cveId": "CVE-2024-8110",
"datePublished": "2024-09-17T02:04:53.739Z",
"dateReserved": "2024-08-23T01:00:38.184Z",
"dateUpdated": "2024-09-17T15:04:05.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-4106 (GCVE-0-2024-4106)
Vulnerability from cvelistv5 – Published: 2024-06-26 05:30 – Updated: 2024-08-01 20:33
VLAI?
Summary
A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product.
The affected products and versions are as follows:
FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
CI Server R1.01.00 to R1.03.00
Severity ?
5.3 (Medium)
CWE
- CWE-258 - Empty Password in Configuration File
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Yokogawa Electric Corporation | FAST/TOOLS |
Affected:
R9.01 , ≤ R10.04
(custom)
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:yokogawa_electric_corporation:fast_tools:r901:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fast_tools",
"vendor": "yokogawa_electric_corporation",
"versions": [
{
"lessThanOrEqual": "R10.04",
"status": "affected",
"version": "r901",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:yokogawa_electric_corporation:ci_server:r1.01.00:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ci_server",
"vendor": "yokogawa_electric_corporation",
"versions": [
{
"lessThanOrEqual": "R1.03.00",
"status": "affected",
"version": "r1.01.00",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-26T13:07:16.655100Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T13:16:08.820Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:33:52.203Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "FAST/TOOLS",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"lessThanOrEqual": "R10.04",
"status": "affected",
"version": "R9.01",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CI Server",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"lessThanOrEqual": "R1.03.00",
"status": "affected",
"version": "R1.01.00",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product.\u003cbr\u003eThe affected products and versions are as follows:\u003cbr\u003eFAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04\u003cbr\u003eCI Server R1.01.00 to R1.03.00"
}
],
"value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product.\nThe affected products and versions are as follows:\nFAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04\nCI Server R1.01.00 to R1.03.00"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-258",
"description": "CWE-258 Empty Password in Configuration File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T05:30:33.928Z",
"orgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"shortName": "YokogawaGroup"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"assignerShortName": "YokogawaGroup",
"cveId": "CVE-2024-4106",
"datePublished": "2024-06-26T05:30:33.928Z",
"dateReserved": "2024-04-23T23:06:05.616Z",
"dateUpdated": "2024-08-01T20:33:52.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-4105 (GCVE-0-2024-4105)
Vulnerability from cvelistv5 – Published: 2024-06-26 05:25 – Updated: 2024-08-01 20:33
VLAI?
Summary
A vulnerability has been found in FAST/TOOLS and CI Server. The affected product's WEB HMI server's function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.
The affected products and versions are as follows:
FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
CI Server R1.01.00 to R1.03.00
Severity ?
5.8 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Yokogawa Electric Corporation | FAST/TOOLS |
Affected:
R9.01 , ≤ R10.04
(custom)
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4105",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-26T17:29:58.387431Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T17:30:23.193Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:33:52.203Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "FAST/TOOLS",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"lessThanOrEqual": "R10.04",
"status": "affected",
"version": "R9.01",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CI Server",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"lessThanOrEqual": "R1.03.00",
"status": "affected",
"version": "R1.01.00",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected product\u0027s WEB HMI server\u0027s function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.\u003cbr\u003eThe affected products and versions are as follows:\u003cbr\u003eFAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04\u003cbr\u003eCI Server R1.01.00 to R1.03.00"
}
],
"value": "A vulnerability has been found in FAST/TOOLS and CI Server. The affected product\u0027s WEB HMI server\u0027s function to process HTTP requests has a security flaw (Reflected XSS) that allows the execution of malicious scripts. Therefore, if a client PC with inadequate security measures accesses a product URL containing a malicious request, the malicious script may be executed on the client PC.\nThe affected products and versions are as follows:\nFAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04\nCI Server R1.01.00 to R1.03.00"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T05:25:04.524Z",
"orgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"shortName": "YokogawaGroup"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"assignerShortName": "YokogawaGroup",
"cveId": "CVE-2024-4105",
"datePublished": "2024-06-26T05:25:04.524Z",
"dateReserved": "2024-04-23T23:06:00.203Z",
"dateUpdated": "2024-08-01T20:33:52.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5650 (GCVE-0-2024-5650)
Vulnerability from cvelistv5 – Published: 2024-06-17 06:21 – Updated: 2024-08-01 21:18
VLAI?
Summary
DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into a computer that installed affected product or access to a shared folder, by replacing the DLL file with a tampered one, it is possible to execute arbitrary programs with the authority of the SYSTEM account.
The affected products and versions are as follows:
CENTUM CS 3000 R3.08.10 to R3.09.50
CENTUM VP R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, R6.01.00 to R6.11.10.
Severity ?
8.5 (High)
CWE
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Yokogawa Electric Corporation | CENTUM CS 3000 |
Affected:
R3.08.10 , ≤ R3.09.50
(custom)
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:yokogawa:centum_cs_3000:r3.08.10:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "centum_cs_3000",
"vendor": "yokogawa",
"versions": [
{
"lessThanOrEqual": "r3.09.50",
"status": "affected",
"version": "r3.08.10",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:yokogawa:centum_vp:r4.01.00:*:*:*:-:*:*:*"
],
"defaultStatus": "unknown",
"product": "centum_vp",
"vendor": "yokogawa",
"versions": [
{
"lessThanOrEqual": "f4.03.00",
"status": "affected",
"version": "r4.01.00",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:yokogawa:centum_vp:r6.01.00:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "centum_vp",
"vendor": "yokogawa",
"versions": [
{
"lessThanOrEqual": "r5.04.20",
"status": "affected",
"version": "r5.01.00",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:yokogawa:centum_vp:r6.01.00:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "centum_vp",
"vendor": "yokogawa",
"versions": [
{
"lessThanOrEqual": "r6.11.10",
"status": "affected",
"version": "r6.01.00",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5650",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-17T13:51:30.100377Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T13:51:32.570Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:06.883Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "CENTUM CS 3000",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"lessThanOrEqual": "R3.09.50",
"status": "affected",
"version": "R3.08.10",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "CENTUM VP",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"lessThanOrEqual": "R4.03.00",
"status": "affected",
"version": "R4.01.00",
"versionType": "custom"
},
{
"lessThanOrEqual": "R5.04.20",
"status": "affected",
"version": "R5.01.00",
"versionType": "custom"
},
{
"lessThanOrEqual": "R6.11.10",
"status": "affected",
"version": "R6.01.00",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-06-17T03:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into a computer that installed affected product or access to a shared folder, by replacing the DLL file with a tampered one, it is possible to execute arbitrary programs with the authority of the SYSTEM account.\u003cbr\u003e\u003cbr\u003eThe affected products and versions are as follows:\u003cbr\u003eCENTUM CS 3000 R3.08.10 to R3.09.50\u003cbr\u003eCENTUM VP R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, R6.01.00 to R6.11.10."
}
],
"value": "DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into a computer that installed affected product or access to a shared folder, by replacing the DLL file with a tampered one, it is possible to execute arbitrary programs with the authority of the SYSTEM account.\n\nThe affected products and versions are as follows:\nCENTUM CS 3000 R3.08.10 to R3.09.50\nCENTUM VP R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, R6.01.00 to R6.11.10."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-17T06:21:31.387Z",
"orgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"shortName": "YokogawaGroup"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"assignerShortName": "YokogawaGroup",
"cveId": "CVE-2024-5650",
"datePublished": "2024-06-17T06:21:31.387Z",
"dateReserved": "2024-06-05T05:32:13.103Z",
"dateUpdated": "2024-08-01T21:18:06.883Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-5915 (GCVE-0-2023-5915)
Vulnerability from cvelistv5 – Published: 2023-12-01 06:12 – Updated: 2024-08-02 08:14
VLAI?
Summary
A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller’s operation is not stopped by the condition.
The affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.
Severity ?
No CVSS data available.
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Yokogawa Electric Corporation | STARDOM |
Affected:
STARDOM FCN/FCJ R1.01 to R4.31
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T08:14:24.685Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://web-material3.yokogawa.com/1/35463/files/YSAR-23-0003-E.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-02"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/vu/JVNVU95177889/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "STARDOM",
"vendor": "Yokogawa Electric Corporation",
"versions": [
{
"status": "affected",
"version": "STARDOM FCN/FCJ R1.01 to R4.31"
}
]
}
],
"datePublic": "2023-12-01T03:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation.\u0026nbsp;This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller\u2019s operation is not stopped by the condition.\u003cbr\u003e\u003cbr\u003eThe affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.\u003cbr\u003e"
}
],
"value": "A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation.\u00a0This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller\u2019s operation is not stopped by the condition.\n\nThe affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.\n"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-12-01T06:14:45.335Z",
"orgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"shortName": "YokogawaGroup"
},
"references": [
{
"url": "https://web-material3.yokogawa.com/1/35463/files/YSAR-23-0003-E.pdf"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-02"
},
{
"url": "https://jvn.jp/vu/JVNVU95177889/index.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7168b535-132a-4efe-a076-338f829b2eb9",
"assignerShortName": "YokogawaGroup",
"cveId": "CVE-2023-5915",
"datePublished": "2023-12-01T06:12:03.581Z",
"dateReserved": "2023-11-02T04:37:11.569Z",
"dateUpdated": "2024-08-02T08:14:24.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}