Search
Find a vulnerability
Search criteria
8 vulnerabilities by Yokogawa Rental & Lease Corporation
CVE-2024-36246 (GCVE-0-2024-36246)
Vulnerability from nvd – Published: 2024-05-31 06:11 – Updated: 2025-04-08 04:36
VLAI
EPSS
VEX
Summary
Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Yokogawa Rental & Lease Corporation | Unifier |
Affected:
Version.5.0 or later but prior to v5.10.6
Affected: and the patch "20240527" not applied |
|
| Yokogawa Rental & Lease Corporation | Unifier Cast |
Affected:
Version.5.0 or later but prior to v5.10.6
Affected: and the patch "20240527" not applied |
|
| Yokogawa Rental & Lease Corporation | Unifier Cast |
Affected:
Version.6.0 or later but prior to v6.5.0
Affected: and the patch "20240527" not applied |
|
| yokogawa_rental_lease_corporation | unifier |
Affected:
5.0 , < *
(custom)
cpe:2.3:a:yokogawa_rental_lease_corporation:unifier:*:*:*:*:*:*:*:* |
|
| yokogawa_rental_lease_corporation | unifier_cast |
Affected:
5.0 , < *
(custom)
cpe:2.3:a:yokogawa_rental_lease_corporation:unifier_cast:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:37:05.247Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN17680667/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:yokogawa_rental_lease_corporation:unifier:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifier",
"vendor": "yokogawa_rental_lease_corporation",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:yokogawa_rental_lease_corporation:unifier_cast:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifier_cast",
"vendor": "yokogawa_rental_lease_corporation",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-36246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-31T16:05:50.833315Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T16:40:23.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Unifier",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.5.0 or later but prior to v5.10.6"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
},
{
"product": "Unifier Cast",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.5.0 or later but prior to v5.10.6"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
},
{
"product": "Unifier Cast",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.6.0 or later but prior to v6.5.0"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T04:36:46.348Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
},
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000007j8.html"
},
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f0000000auf.html"
},
{
"url": "https://jvn.jp/en/jp/JVN17680667/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36246",
"datePublished": "2024-05-31T06:11:22.238Z",
"dateReserved": "2024-05-22T04:37:30.990Z",
"dateUpdated": "2025-04-08T04:36:46.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-23847 (GCVE-0-2024-23847)
Vulnerability from nvd – Published: 2024-05-31 06:11 – Updated: 2025-04-08 04:36
VLAI
EPSS
VEX
Summary
Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted.
Severity
7.8 (High)
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Yokogawa Rental & Lease Corporation | Unifier |
Affected:
Version.5.0 or later but prior to v5.10.6
Affected: and the patch "20240527" not applied |
|
| Yokogawa Rental & Lease Corporation | Unifier Cast |
Affected:
Version.5.0 or later but prior to v5.10.6
Affected: and the patch "20240527" not applied |
|
| Yokogawa Rental & Lease Corporation | Unifier Cast |
Affected:
Version.6.0 or later but prior to v6.5.0
Affected: and the patch "20240527" not applied |
|
| yokogawa_rental_lease_corporation | unifier |
Affected:
5.0 , < 5.10
(custom)
cpe:2.3:a:yokogawa_rental_lease_corporation:unifier:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:yokogawa_rental_lease_corporation:unifier:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifier",
"vendor": "yokogawa_rental_lease_corporation",
"versions": [
{
"lessThan": "5.10",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-23847",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-06T18:05:15.775654Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T18:24:08.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:13:08.240Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN17680667/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Unifier",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.5.0 or later but prior to v5.10.6"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
},
{
"product": "Unifier Cast",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.5.0 or later but prior to v5.10.6"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
},
{
"product": "Unifier Cast",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.6.0 or later but prior to v6.5.0"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "Incorrect default permissions",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T04:36:31.500Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
},
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000007j8.html"
},
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f0000000auf.html"
},
{
"url": "https://jvn.jp/en/jp/JVN17680667/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-23847",
"datePublished": "2024-05-31T06:11:15.428Z",
"dateReserved": "2024-01-23T07:00:54.325Z",
"dateUpdated": "2025-04-08T04:36:31.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-34866 (GCVE-0-2022-34866)
Vulnerability from nvd – Published: 2022-07-20 06:15 – Updated: 2024-08-03 09:22
VLAI
EPSS
VEX
Summary
Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running.
Severity
No CVSS data available.
CWE
- Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.yrl.com/fwp_support/info/a1hrbt000000… | x_refsource_MISC |
| https://jvn.jp/en/jp/JVN23766146/index.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yokogawa Rental & Lease Corporation | Passage Drive |
Affected:
Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:22:10.623Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN23766146/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Passage Drive",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Input Validation",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-20T06:15:28.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/en/jp/JVN23766146/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2022-34866",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Passage Drive",
"version": {
"version_data": [
{
"version_value": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0"
}
]
}
}
]
},
"vendor_name": "Yokogawa Rental \u0026 Lease Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html",
"refsource": "MISC",
"url": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html"
},
{
"name": "https://jvn.jp/en/jp/JVN23766146/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/en/jp/JVN23766146/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2022-34866",
"datePublished": "2022-07-20T06:15:28.000Z",
"dateReserved": "2022-07-06T00:00:00.000Z",
"dateUpdated": "2024-08-03T09:22:10.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36246 (GCVE-0-2024-36246)
Vulnerability from cvelistv5 – Published: 2024-05-31 06:11 – Updated: 2025-04-08 04:36
VLAI
EPSS
VEX
Summary
Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Yokogawa Rental & Lease Corporation | Unifier |
Affected:
Version.5.0 or later but prior to v5.10.6
Affected: and the patch "20240527" not applied |
|
| Yokogawa Rental & Lease Corporation | Unifier Cast |
Affected:
Version.5.0 or later but prior to v5.10.6
Affected: and the patch "20240527" not applied |
|
| Yokogawa Rental & Lease Corporation | Unifier Cast |
Affected:
Version.6.0 or later but prior to v6.5.0
Affected: and the patch "20240527" not applied |
|
| yokogawa_rental_lease_corporation | unifier |
Affected:
5.0 , < *
(custom)
cpe:2.3:a:yokogawa_rental_lease_corporation:unifier:*:*:*:*:*:*:*:* |
|
| yokogawa_rental_lease_corporation | unifier_cast |
Affected:
5.0 , < *
(custom)
cpe:2.3:a:yokogawa_rental_lease_corporation:unifier_cast:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:37:05.247Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN17680667/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:yokogawa_rental_lease_corporation:unifier:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifier",
"vendor": "yokogawa_rental_lease_corporation",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:yokogawa_rental_lease_corporation:unifier_cast:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifier_cast",
"vendor": "yokogawa_rental_lease_corporation",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-36246",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-31T16:05:50.833315Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-08-15T16:40:23.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Unifier",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.5.0 or later but prior to v5.10.6"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
},
{
"product": "Unifier Cast",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.5.0 or later but prior to v5.10.6"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
},
{
"product": "Unifier Cast",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.6.0 or later but prior to v6.5.0"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing authorization",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T04:36:46.348Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
},
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000007j8.html"
},
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f0000000auf.html"
},
{
"url": "https://jvn.jp/en/jp/JVN17680667/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-36246",
"datePublished": "2024-05-31T06:11:22.238Z",
"dateReserved": "2024-05-22T04:37:30.990Z",
"dateUpdated": "2025-04-08T04:36:46.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-23847 (GCVE-0-2024-23847)
Vulnerability from cvelistv5 – Published: 2024-05-31 06:11 – Updated: 2025-04-08 04:36
VLAI
EPSS
VEX
Summary
Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted.
Severity
7.8 (High)
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Yokogawa Rental & Lease Corporation | Unifier |
Affected:
Version.5.0 or later but prior to v5.10.6
Affected: and the patch "20240527" not applied |
|
| Yokogawa Rental & Lease Corporation | Unifier Cast |
Affected:
Version.5.0 or later but prior to v5.10.6
Affected: and the patch "20240527" not applied |
|
| Yokogawa Rental & Lease Corporation | Unifier Cast |
Affected:
Version.6.0 or later but prior to v6.5.0
Affected: and the patch "20240527" not applied |
|
| yokogawa_rental_lease_corporation | unifier |
Affected:
5.0 , < 5.10
(custom)
cpe:2.3:a:yokogawa_rental_lease_corporation:unifier:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:yokogawa_rental_lease_corporation:unifier:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifier",
"vendor": "yokogawa_rental_lease_corporation",
"versions": [
{
"lessThan": "5.10",
"status": "affected",
"version": "5.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-23847",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-06T18:05:15.775654Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T18:24:08.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:13:08.240Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN17680667/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Unifier",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.5.0 or later but prior to v5.10.6"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
},
{
"product": "Unifier Cast",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.5.0 or later but prior to v5.10.6"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
},
{
"product": "Unifier Cast",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Version.6.0 or later but prior to v6.5.0"
},
{
"status": "affected",
"version": "and the patch \"20240527\" not applied"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "Incorrect default permissions",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-08T04:36:31.500Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000000q7.html"
},
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f00000007j8.html"
},
{
"url": "https://www.yrl.com/fwp_support/info/khvu7f0000000auf.html"
},
{
"url": "https://jvn.jp/en/jp/JVN17680667/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2024-23847",
"datePublished": "2024-05-31T06:11:15.428Z",
"dateReserved": "2024-01-23T07:00:54.325Z",
"dateUpdated": "2025-04-08T04:36:31.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-34866 (GCVE-0-2022-34866)
Vulnerability from cvelistv5 – Published: 2022-07-20 06:15 – Updated: 2024-08-03 09:22
VLAI
EPSS
VEX
Summary
Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running.
Severity
No CVSS data available.
CWE
- Improper Input Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.yrl.com/fwp_support/info/a1hrbt000000… | x_refsource_MISC |
| https://jvn.jp/en/jp/JVN23766146/index.html | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Yokogawa Rental & Lease Corporation | Passage Drive |
Affected:
Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:22:10.623Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN23766146/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Passage Drive",
"vendor": "Yokogawa Rental \u0026 Lease Corporation",
"versions": [
{
"status": "affected",
"version": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Improper Input Validation",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-20T06:15:28.000Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/en/jp/JVN23766146/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2022-34866",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Passage Drive",
"version": {
"version_data": [
{
"version_value": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0"
}
]
}
}
]
},
"vendor_name": "Yokogawa Rental \u0026 Lease Corporation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Passage Drive versions v1.4.0 to v1.5.1.0 and Passage Drive for Box version v1.0.0 contain an insufficient data verification vulnerability for interprocess communication. By running a malicious program, an arbitrary OS command may be executed with LocalSystem privilege of the Windows system where the product is running."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Improper Input Validation"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html",
"refsource": "MISC",
"url": "https://www.yrl.com/fwp_support/info/a1hrbt0000002037.html"
},
{
"name": "https://jvn.jp/en/jp/JVN23766146/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/en/jp/JVN23766146/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2022-34866",
"datePublished": "2022-07-20T06:15:28.000Z",
"dateReserved": "2022-07-06T00:00:00.000Z",
"dateUpdated": "2024-08-03T09:22:10.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
JVNDB-2024-000053
Vulnerability from jvndb - Published: 2024-05-28 14:47 - Updated:2024-05-28 14:47
Severity
Summary
Multiple vulnerabilities in Unifier and Unifier Cast
Details
Unifier and Unifier Cast provided by Yokogawa Rental & Lease Corporation contains multiple vulnerabilities listed below.
CVE-2024-23847
Yokogawa Rental & Lease Corporation reported this vulnerability to IPA to notify users of its solution through JVN.
JPCERT/CC and Yokogawa Rental & Lease Corporation coordinated under the Information Security Early Warning Partnership.
CVE-2024-36246
Taisei Ogura of MOTEX Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000053.html",
"dc:date": "2024-05-28T14:47+09:00",
"dcterms:issued": "2024-05-28T14:47+09:00",
"dcterms:modified": "2024-05-28T14:47+09:00",
"description": "Unifier and Unifier Cast provided by Yokogawa Rental \u0026 Lease Corporation contains multiple vulnerabilities listed below.\r\n\r\n\u003cul\u003e\r\n\t\u003cli\u003e\u003cb\u003eIncorrect Default Permissions configured by Cast Launcher (\u003ca href=\"https://cwe.mitre.org/data/definitions/276.html\"\u003eCWE-276\u003c/a\u003e)\u003c/b\u003e - CVE-2024-23847\r\n\t\u003c/li\u003e\r\n\t\u003cli\u003e\u003cb\u003eMissing Authorization for coejobhook Command Execution (\u003ca href=\"https://cwe.mitre.org/data/definitions/862.html\"\u003eCWE-862\u003c/a\u003e)\u003c/b\u003e - CVE-2024-36246\r\n\t\u003c/li\u003e\r\n\u003c/ul\u003e\r\n\r\nCVE-2024-23847\r\nYokogawa Rental \u0026 Lease Corporation reported this vulnerability to IPA to notify users of its solution through JVN.\r\nJPCERT/CC and Yokogawa Rental \u0026 Lease Corporation coordinated under the Information Security Early Warning Partnership.\r\n\r\nCVE-2024-36246\r\nTaisei Ogura of MOTEX Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2024/JVNDB-2024-000053.html",
"sec:cpe": [
{
"#text": "cpe:/a:yrl:yokogawa_renta_unifier",
"@product": "Unifier",
"@vendor": "Yokogawa Rental \u0026 Lease Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/a:yrl:yokogawa_renta_unifier_cast",
"@product": "Unifier Cast",
"@vendor": "Yokogawa Rental \u0026 Lease Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/a:yrl:yokogawa_renta_unifier_cast",
"@product": "Unifier Cast",
"@vendor": "Yokogawa Rental \u0026 Lease Corporation",
"@version": "2.2"
}
],
"sec:cvss": {
"@score": "9.8",
"@severity": "Critical",
"@type": "Base",
"@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"@version": "3.0"
},
"sec:identifier": "JVNDB-2024-000053",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN17680667/index.html",
"@id": "JVN#17680667",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-23847",
"@id": "CVE-2024-23847",
"@source": "CVE"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2024-36246",
"@id": "CVE-2024-36246",
"@source": "CVE"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-Other",
"@title": "No Mapping(CWE-Other)"
}
],
"title": "Multiple vulnerabilities in Unifier and Unifier Cast"
}
JVNDB-2022-000052
Vulnerability from jvndb - Published: 2022-07-08 13:42 - Updated:2024-06-14 17:48
Severity
Summary
Passage Drive vulnerable to insufficient data verification
Details
Passage Drive provided by Yokogawa Rental & Lease Corporation contains an insufficient data verification vulnerability for interprocess communication (CWE-20).
Yokogawa Rental & Lease Corporation reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Yokogawa Rental & Lease Corporation coordinated under the Information Security Early Warning Partnership.
References
| Type | URL | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000052.html",
"dc:date": "2024-06-14T17:48+09:00",
"dcterms:issued": "2022-07-08T13:42+09:00",
"dcterms:modified": "2024-06-14T17:48+09:00",
"description": "Passage Drive provided by Yokogawa Rental \u0026 Lease Corporation contains an insufficient data verification vulnerability for interprocess communication (CWE-20).\r\n\r\nYokogawa Rental \u0026 Lease Corporation reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Yokogawa Rental \u0026 Lease Corporation coordinated under the Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2022/JVNDB-2022-000052.html",
"sec:cpe": [
{
"#text": "cpe:/a:yrl:passage_drive",
"@product": "Passage Drive",
"@vendor": "Yokogawa Rental \u0026 Lease Corporation",
"@version": "2.2"
},
{
"#text": "cpe:/a:yrl:passage_drive_for_box",
"@product": "Passage Drive for Box",
"@vendor": "Yokogawa Rental \u0026 Lease Corporation",
"@version": "2.2"
}
],
"sec:cvss": [
{
"@score": "9.3",
"@severity": "High",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"@version": "2.0"
},
{
"@score": "8.6",
"@severity": "High",
"@type": "Base",
"@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"@version": "3.0"
}
],
"sec:identifier": "JVNDB-2022-000052",
"sec:references": [
{
"#text": "http://jvn.jp/en/jp/JVN23766146/index.html",
"@id": "JVN#23766146",
"@source": "JVN"
},
{
"#text": "https://www.cve.org/CVERecord?id=CVE-2022-34866",
"@id": "CVE-2022-34866",
"@source": "CVE"
},
{
"#text": "https://nvd.nist.gov/vuln/detail/CVE-2022-34866",
"@id": "CVE-2022-34866",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-20",
"@title": "Improper Input Validation(CWE-20)"
}
],
"title": "Passage Drive vulnerable to insufficient data verification"
}