CVE-2018-17898 Denial of service in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
An attacker can cause instability in Yokogawa STARDOM controllers by sending unauthorized requests that exhaust memory, leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-17898?
CVE-2018-17898 is a high-severity denial of service vulnerability in Yokogawa STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500, published on 12 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yokogawa STARDOM Controllers FCJ,FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The controller application fails to prevent memory exhaustion by unauthorized requests. This could allow an attacker to cause the controller to become unstable.
Weakness: CWE-400
Which versions are affected by CVE-2018-17898?
It affects 4 products.
Products include Yokogawa Fcj Firmware, Yokogawa Fcn-100 Firmware, Yokogawa Fcn-500 Firmware, Yokogawa Fcn-Rtu Firmware.
How do I fix CVE-2018-17898?
No fix has been published for CVE-2018-17898 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-17898 being exploited?
There is no known exploitation of CVE-2018-17898 in the wild and no public exploit code.
Other vulnerabilities in Yokogawa STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-17900 Information disclosure in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-10592 Hardcoded credentials in STARDOM FCJ Controllers
- CVE-2018-17896 Hardcoded credentials in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-17902 Denial of service in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
Sources
Also known as GHSA-jj2r-mj3g-9h98.