CVE-2022-29519

Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware.

CVSS v3.0 7.5 HIGH
CVSS v2.0 7.9 HIGH

7.5^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.9^/10

CVSS v2.0 : HIGH

Vector : AV:A/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 5.5 / Impact : 10.0

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01	Mitigation Third Party Advisory US Government Resource
https://jvn.jp/vu/JVNVU95452299/index.html	Mitigation Third Party Advisory VDB Entry
https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf	Mitigation Vendor Advisory
https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf	Mitigation Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:yokogawa:stardom_fcj_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:yokogawa:stardom_fcj:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:yokogawa:stardom_fcn_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:yokogawa:stardom_fcn:-:*:*:*:*:*:*:*

Information

Published : 2022-06-28 06:15

Updated : 2022-07-08 07:57

NVD link : CVE-2022-29519

Mitre link : CVE-2022-29519

JSON object : View

CWE

CWE-319

Cleartext Transmission of Sensitive Information

Advertisement

Products Affected

yokogawa

stardom_fcn
stardom_fcn_firmware
stardom_fcj_firmware
stardom_fcj

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01", "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "refsource": "MISC"}, {"url": "https://jvn.jp/vu/JVNVU95452299/index.html", "name": "https://jvn.jp/vu/JVNVU95452299/index.html", "tags": ["Mitigation", "Third Party Advisory", "VDB Entry"], "refsource": "MISC"}, {"url": "https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf", "name": "https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf", "tags": ["Mitigation", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf", "name": "https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf", "tags": ["Mitigation", "Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-319"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-29519", "ASSIGNER": "vultures@jpcert.or.jp"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.9, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}}, "publishedDate": "2022-06-28T13:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:yokogawa:stardom_fcj_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "r4.31", "versionStartIncluding": "r1.01"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:yokogawa:stardom_fcj:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}, {"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:yokogawa:stardom_fcn_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "r4.31", "versionStartIncluding": "r1.01"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:h:yokogawa:stardom_fcn:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-07-08T14:57Z"}