CVE-2018-10592

high-risk
Published 2018-07-31

Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution.

Do I need to act?

~
6.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (4)

Fcj Firmware
Fcn-100 Firmware
Fcn-Rtu Firmware
Fcn-500 Firmware

Affected Vendors

Yokogawa

References (6)

Third Party Advisory http://www.securityfocus.com/bid/104376
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03
Vendor Advisory https://web-material3.yokogawa.com/1/6712/details/YSAR-18-0004-E.pdf
Third Party Advisory http://www.securityfocus.com/bid/104376
Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03
Vendor Advisory https://web-material3.yokogawa.com/1/6712/details/YSAR-18-0004-E.pdf
51
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 9/34 · Low
Exposure 10/34 · Low