9.8

CVE-2018-17900

Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentials which could allow an attacker to obtain credentials for remote access to controllers.

Data is provided by the National Vulnerability Database (NVD)
Yokogawa ≫ Fcj Firmware Version <= r4.10
   Yokogawa ≫ Fcj Version-
Yokogawa ≫ Fcn-100 Firmware Version <= r4.10
   Yokogawa ≫ Fcn-100 Version-
Yokogawa ≫ Fcn-rtu Firmware Version <= r4.10
   Yokogawa ≫ Fcn-rtu Version-
Yokogawa ≫ Fcn-500 Firmware Version <= r4.10
   Yokogawa ≫ Fcn-500 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.26% 0.466
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03
Third Party Advisory
US Government Resource