Medium severity · published Jun 26, 2024
CVE-2024-4106
A vulnerability has been found in FAST/TOOLS and CI Server
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product.
The affected products and versions are as follows:
FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
CI Server R1.01.00 to R1.03.00
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
CI Server · Yokogawa Electric Corporation
R1.01.00 through R1.03.00 · source: vendor, CISA
FA
FAST/TOOLS · Yokogawa Electric Corporation
R9.01 through R10.04 · source: vendor
FT
Fast Tools · Yokogawa Electric Corporation
r901 through R10.04 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4106
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4106
web-material3.yokogawa.com
https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf
More from CI Server
8.2
CVE-2026-11833
Overview: A vulnerability has been found in FAST/TOOLS and CI Server
5.8
CVE-2024-4105
A vulnerability has been found in FAST/TOOLS and CI Server