CVE-2022-29519 - Vulnerability Details - OpenCVE

Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Yokogawa	Stardom Fcj Stardom Fcj Firmware Stardom Fcn Stardom Fcn Firmware

Configuration 1 [-]

AND

cpe:2.3:o:yokogawa:stardom_fcj_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:yokogawa:stardom_fcj:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:yokogawa:stardom_fcn_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:yokogawa:stardom_fcn:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://jvn.jp/vu/JVNVU95452299/index.html
https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf
https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2022-06-28T10:05:31

Updated: 2024-08-03T06:26:05.949Z

Reserved: 2022-05-31T00:00:00

Link: CVE-2022-29519

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-06-28T13:15:12.377

Modified: 2024-11-21T06:59:14.890

Link: CVE-2022-29519

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "STARDOM Controller", "vendor": "Yokogawa Electric Corporation", "versions": [{"status": "affected", "version": "STARDOM FCN Controller and FCJ Controller R1.01 to R4.31"}]}], "descriptions": [{"lang": "en", "value": "Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware."}], "problemTypes": [{"descriptions": [{"description": "Cleartext Transmission of Sensitive Information", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-06-28T10:05:31", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf"}, {"tags": ["x_refsource_MISC"], "url": "https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf"}, {"tags": ["x_refsource_MISC"], "url": "https://jvn.jp/vu/JVNVU95452299/index.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2022-29519", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "STARDOM Controller", "version": {"version_data": [{"version_value": "STARDOM FCN Controller and FCJ Controller R1.01 to R4.31"}]}}]}, "vendor_name": "Yokogawa Electric Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cleartext Transmission of Sensitive Information"}]}]}, "references": {"reference_data": [{"name": "https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf", "refsource": "MISC", "url": "https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf"}, {"name": "https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf", "refsource": "MISC", "url": "https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf"}, {"name": "https://jvn.jp/vu/JVNVU95452299/index.html", "refsource": "MISC", "url": "https://jvn.jp/vu/JVNVU95452299/index.html"}, {"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:26:05.949Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jvn.jp/vu/JVNVU95452299/index.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2022-29519", "datePublished": "2022-06-28T10:05:31", "dateReserved": "2022-05-31T00:00:00", "dateUpdated": "2024-08-03T06:26:05.949Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:yokogawa:stardom_fcj_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "03BF3DA1-FA1C-4633-A665-EE5826650EC8", "versionEndIncluding": "r4.31", "versionStartIncluding": "r1.01", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:yokogawa:stardom_fcj:-:*:*:*:*:*:*:*", "matchCriteriaId": "37EFAADB-EF41-4B63-A9C4-9A410682F47D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:yokogawa:stardom_fcn_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "A08E6234-7D44-4C8D-9D5B-373A085D0716", "versionEndIncluding": "r4.31", "versionStartIncluding": "r1.01", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:yokogawa:stardom_fcn:-:*:*:*:*:*:*:*", "matchCriteriaId": "6051604E-7FAF-44D7-BDB6-7D2D71DFC416", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de transmisi\u00f3n de texto sin cifrar de informaci\u00f3n confidencial en STARDOM FCN Controller y FCJ Controller versiones R1.01 a R4.31, que puede permitir a un atacante adyacente iniciar sesi\u00f3n en los productos afectados y alterar los ajustes de configuraci\u00f3n del dispositivo o manipular el firmware del mismo"}], "id": "CVE-2022-29519", "lastModified": "2024-11-21T06:59:14.890", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:A/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 5.5, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-28T13:15:12.377", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Mitigation", "Third Party Advisory", "VDB Entry"], "url": "https://jvn.jp/vu/JVNVU95452299/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf"}, {"source": "vultures@jpcert.or.jp", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf"}, {"source": "vultures@jpcert.or.jp", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory", "VDB Entry"], "url": "https://jvn.jp/vu/JVNVU95452299/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}