High severity · published Oct 12, 2018
CVE-2018-17896
Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded credentials which may allow an attacker gain…
8.1
CVSS
1.2%
EPSS
No
On KEV
Description
Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The affected controllers utilize hard-coded credentials which may allow an attacker gain unauthorized access to the maintenance functions and obtain or modify information. This attack can be executed only during maintenance work.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fcj Firmware · Yokogawa
through r4.10 · source: NVD
FF
Fcn-100 Firmware · Yokogawa
through r4.10 · source: NVD
FF
Fcn-500 Firmware · Yokogawa
through r4.10 · source: NVD
FF
Fcn-rtu Firmware · Yokogawa
through r4.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-17896
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-17896
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03
Vendor Advisory
https://web-material3.yokogawa.com/YSAR-18-0007-E.pdf
More from Fcj Firmware
9.8
CVE-2018-17900
Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentials which could allow an attacker to…
9.8
CVE-2018-10592
Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize…
7.5
CVE-2018-17898
Yokogawa STARDOM Controllers FCJ,FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The controller application fails to prevent memory exhaustion by unauthorized requests
5.3
CVE-2018-17902
Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The application utilizes multiple methods of session management which could result in a…