PT-2018-3923 · Yokogawa · Fcn-Rtu+3

Publicado 2018-09-28 · Atualizado 2019-10-09 · CVE-2018-17896

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500 versions R4.10 and prior

Description The issue concerns the use of hard-coded credentials in the affected controllers, which may allow an attacker to gain unauthorized access to maintenance functions and obtain or modify information. This attack can only be executed during maintenance work. The vulnerability may enable a remote attacker to access protected information.

Recommendations For versions R4.10 and prior, consider changing the hard-coded credentials to unique, secure credentials to prevent unauthorized access. As a temporary workaround, restrict access to maintenance functions until a patch is available.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

BDU:2023-03617

CVE-2018-17896

Produtos afetados

Fcn-100

Fcn-500

Fcn-Rtu

Stardom Fcn Controller

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-17896 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-03617 · Nota de Segurança
• https://web-material3.yokogawa.com/YSAR-18-0007-E.pdf · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03 · Nota
• https://osv.dev/vulnerability/CVE-2018-17896 · Aviso do Fabricante
• https://vuldb.com/?id.125281 · Nota