CVE-2018-17902 Denial of service in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
Multiple session management methods in Yokogawa STARDOM controllers can cause denial of service to remote management functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-17902?
CVE-2018-17902 is a medium-severity denial of service vulnerability in Yokogawa STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500, published on 12 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The application utilizes multiple methods of session management which could result in a denial of service to the remote management functions.
Weakness: CWE-384
Which versions are affected by CVE-2018-17902?
It affects 4 products.
Products include Yokogawa Fcj Firmware, Yokogawa Fcn-100 Firmware, Yokogawa Fcn-500 Firmware, Yokogawa Fcn-Rtu Firmware.
How do I fix CVE-2018-17902?
No fix has been published for CVE-2018-17902 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-17902 being exploited?
There is no known exploitation of CVE-2018-17902 in the wild and no public exploit code.
Other vulnerabilities in Yokogawa STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-17900 Information disclosure in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-10592 Hardcoded credentials in STARDOM FCJ Controllers
- CVE-2018-17896 Hardcoded credentials in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
- CVE-2018-17898 Denial of service in STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500
Sources
Also known as GHSA-w3f9-4vpm-p9h8.