CVE-2022-29519
Last modified
CVE-2022-29519 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware.. EPSS estimates a 0.38% chance of exploitation in the next 30 days.
Description
Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware.
Metrics
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Yokogawa | Stardom Fcj Firmware | >= r1.01, <= r4.31 |
| Yokogawa | Stardom Fcn Firmware | >= r1.01, <= r4.31 |
References
- https://jvn.jp/vu/JVNVU95452299/index.htmlMitigation, Third Party Advisory, VDB Entry
- https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdfMitigation, Vendor Advisory
- https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdfMitigation, Vendor Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01Mitigation, Third Party Advisory, US Government Resource
- https://jvn.jp/vu/JVNVU95452299/index.htmlMitigation, Third Party Advisory, VDB Entry
- https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdfMitigation, Vendor Advisory
- https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdfMitigation, Vendor Advisory
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01Mitigation, Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-29519?
How severe is CVE-2022-29519?
How do I fix CVE-2022-29519?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-29513Cross-site scripting vulnerability in Scheduler of Cybozu Ga…4.8
- CVE-2022-29514Improper access control in the Intel(R) SUR software before …9.8
- CVE-2022-29515Missing release of memory after effective lifetime in firmwa…5.5
- CVE-2022-29516The web console of FUJITSU Network IPCOM series (IPCOM EX2 I…9.8
- CVE-2022-29517A directory traversal vulnerability exists in the HelpdeskAc…8.8
- CVE-2022-29518Screen Creator Advance2, HMI GC-A2 series, and Real time rem…7
- CVE-2022-2952GE CIMPICITY versions 2022 and prior is vulnerable when da…7.8
- CVE-2022-29520An OS command injection vulnerability exists in the console_…9.8
- CVE-2022-29522Use after free vulnerability exists in the simulator module …7.8
- CVE-2022-29523Improper conditions check in the Open CAS software maintaine…5.5
- CVE-2022-29524Out-of-bounds write vulnerability exists in V-Server v4.0.11…7.8
- CVE-2022-29525Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-…9.8
Are you affected by CVE-2022-29519?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST