Empty Password in Configuration File in Yokogawa products - CVE-2024-4106

Vulnerability identifier: #VU93511

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-4106

CWE-ID: CWE-258

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected products have built-in accounts with no passwords set. A remote attacker can break into the affected product if the product is operated without a password set by default.

FAST/TOOLS RVSVRN Package
FAST/TOOLS UNSVRN Package
CI Server
FAST/TOOLS HMIMOB Package
FAST/TOOLS HMIWEB Package
FAST/TOOLS FTEES Package

Install updates from vendor's website.

FAST/TOOLS RVSVRN Package - update to R10.04 SP3
FAST/TOOLS UNSVRN Package - update to R10.04 SP3
CI Server - update to R10.04 SP3
FAST/TOOLS HMIMOB Package - update to R10.04 SP3
FAST/TOOLS HMIWEB Package - update to R10.04 SP3
FAST/TOOLS FTEES Package - update to R10.04 SP3

• https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-03

• Multiple vulnerabilities in Yokogawa FAST/TOOLS and CI Server