Vulnerability · Published Jun 28, 2022 · Assigned by jpcert
CVE-2022-30997
Medium 6.3
In plain English
A medium-severity hard-coded credentials in STARDOM Controller from Yokogawa Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)1.6%top 24.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Yokogawa Electric Corporation | STARDOM Controller | STARDOM FCN Controller and FCJ Controller R4.10 to R4.31 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
References
- https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf x_refsource_MISC
- https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf x_refsource_MISC
- https://jvn.jp/vu/JVNVU95452299/index.html x_refsource_MISC
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01 x_refsource_MISC