CVE-2018-10592 Hardcoded credentials in STARDOM FCJ Controllers
Hard-coded credentials in Yokogawa STARDOM controllers allow attackers to gain administrative access and execute remote code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-10592?
CVE-2018-10592 is a critical vulnerability in Yokogawa STARDOM FCJ Controllers, published on 31 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution.
Weakness: CWE-798
Which versions are affected by CVE-2018-10592?
It affects 4 products.
Products include Yokogawa Fcj Firmware, Yokogawa Fcn-100 Firmware, Yokogawa Fcn-500 Firmware, Yokogawa Fcn-Rtu Firmware.
How do I fix CVE-2018-10592?
No fix has been published for CVE-2018-10592 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-10592 being exploited?
There is no known exploitation of CVE-2018-10592 in the wild and no public exploit code.
Other vulnerabilities in Yokogawa STARDOM FCJ Controllers
- CVE-2018-17900 Information disclosure in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-17896 Hardcoded credentials in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-17898 Denial of service in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-17902 Denial of service in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
Sources
Also known as GHSA-m6xr-cgmm-vx52.