PT-2018-3923 · Yokogawa · Fcn-Rtu+3

Published 2018-09-28 · Updated 2019-10-09 · CVE-2018-17896

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500 versions R4.10 and prior

Description The issue concerns the use of hard-coded credentials in the affected controllers, which may allow an attacker to gain unauthorized access to maintenance functions and obtain or modify information. This attack can only be executed during maintenance work. The vulnerability may enable a remote attacker to access protected information.

Recommendations For versions R4.10 and prior, consider changing the hard-coded credentials to unique, secure credentials to prevent unauthorized access. As a temporary workaround, restrict access to maintenance functions until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2023-03617

CVE-2018-17896

Affected Products

Fcn-100

Fcn-500

Fcn-Rtu

Stardom Fcn Controller

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-17896 · Security Note
• https://bdu.fstec.ru/vul/2023-03617 · Security Note
• https://web-material3.yokogawa.com/YSAR-18-0007-E.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-17896 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03 · Note
• https://vuldb.com/?id.125281 · Note