High severity · published Jun 28, 2022
CVE-2022-30997
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to…
7.2
CVSS
1.6%
EPSS
No
On KEV
Description
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Stardom Fcj Firmware · Yokogawa
r4.10 through r4.31 · source: NVD
SF
Stardom Fcn Firmware · Yokogawa
r4.10 through r4.31 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-30997
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-30997
Mitigation
https://jvn.jp/vu/JVNVU95452299/index.html
Mitigation
https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf
Mitigation
https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf
Mitigation
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01
More from Stardom Fcj Firmware
7.5
CVE-2022-29519
Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the…
5.3
CVE-2023-5915
A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to a remote attacker to…