Vulnerability-Lookup

VAR-201807-0332

Vulnerability from variot - Updated: 2024-11-23 21:52

Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution. Provided by Yokogawa Electric Corporation STARDOM There are multiple vulnerabilities in the controller. Provided by Yokogawa Electric Corporation STARDOM For small and medium-sized factories PLC Instrumentation system. STARDOM The controller contains several vulnerabilities: * * account ID And password information is hard-coded (CWE-798) - CVE-2018-10592 * * information leak (CWE-200) - CVE-2018-17900 * * Service disruption to remote management functions (DoS) (CWE-119) - CVE-2018-17902 * * Problems with hardcoded authentication information for maintenance functions (CWE-798) - CVE-2018-17896 * * Controller HTTP Service disruption to services (DoS) (CWE-119) - CVE-2018-17898The expected impact depends on each vulnerability, but can be affected as follows: * * A remote attacker can log into the controller and execute arbitrary commands - CVE-2018-10592 * * Authentication information for accessing the remote management function of the controller can be obtained by a remote third party - CVE-2018-17900 * * Remote operation by the remote party to the remote management function of the controller (DoS) Attack is done - CVE-2018-17902 * * A remote attacker logs in to the controller's maintenance function, acquires information, and falsifies - CVE-2018-17896 * * By a remote third party HTTP Service disruption to services (DoS) Attack is done - CVE-2018-17898. Yokogawa FCJ and the like are controllers used in network control systems by Yokogawa Corporation of Japan. There are security bypass vulnerabilities in various Yokogawa products. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service in the context of an affected device. Failed attempts will likely cause a denial-of-service condition. Yokogawa FCJ, etc. The following products and versions are affected: Yokogawa STARDOM FCJ R4.02 and earlier; FCN-100 R4.02 and earlier; FCN-RTU R4.02 and earlier; FCN-500 R4.02 and earlier

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201807-0332",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "fcj",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "yokogawa",
        "version": "r4.02"
      },
      {
        "model": "fcn-500",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "yokogawa",
        "version": "r4.02"
      },
      {
        "model": "fcn-rtu",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "yokogawa",
        "version": "r4.02"
      },
      {
        "model": "fcn-100",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "yokogawa",
        "version": "r4.02"
      },
      {
        "model": "stardom fcj",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "yokogawa electric",
        "version": "r4.02"
      },
      {
        "model": "stardom fcj",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "yokogawa electric",
        "version": "r4.10"
      },
      {
        "model": "stardom fcn-100",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "yokogawa electric",
        "version": "r4.02"
      },
      {
        "model": "stardom fcn-100",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "yokogawa electric",
        "version": "r4.10"
      },
      {
        "model": "stardom fcn-500",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "yokogawa electric",
        "version": "r4.02"
      },
      {
        "model": "stardom fcn-500",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "yokogawa electric",
        "version": "r4.10"
      },
      {
        "model": "stardom fcn-rtu",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "yokogawa electric",
        "version": "r4.02"
      },
      {
        "model": "stardom fcn-rtu",
        "scope": "lte",
        "trust": 0.8,
        "vendor": "yokogawa electric",
        "version": "r4.10"
      },
      {
        "model": "fcj \u003c=r4.02",
        "scope": null,
        "trust": 0.6,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-100 \u003c=r4.02",
        "scope": null,
        "trust": 0.6,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-rtu \u003c=r4.02",
        "scope": null,
        "trust": 0.6,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-500 \u003c=r4.02",
        "scope": null,
        "trust": 0.6,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-100",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "yokogawa",
        "version": "r4.02"
      },
      {
        "model": "fcn-500",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "yokogawa",
        "version": "r4.02"
      },
      {
        "model": "fcn-rtu",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "yokogawa",
        "version": "r4.02"
      },
      {
        "model": "fcj",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "yokogawa",
        "version": "r4.02"
      },
      {
        "model": "stardom fcj r4.02",
        "scope": null,
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "stardom fcj r4.01",
        "scope": null,
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "stardom fcj r1.01",
        "scope": null,
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-rtu r4.02",
        "scope": null,
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-500 r4.02",
        "scope": null,
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-100 r4.02",
        "scope": null,
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "stardom fcj r4.10",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-rtu r4.10",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-500 r4.10",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": "fcn-100 r4.10",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "yokogawa",
        "version": null
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "fcj",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "fcn 100",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "fcn rtu",
        "version": "*"
      },
      {
        "model": null,
        "scope": "eq",
        "trust": 0.2,
        "vendor": "fcn 500",
        "version": "*"
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "db": "BID",
        "id": "104376"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-10592"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:yokogawa:fcj_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:yokogawa:fcn-100_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:yokogawa:fcn-500_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:yokogawa:fcn-rtu_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "VDLab of Venustech and Dongfang Electric Corporation (DEC)",
    "sources": [
      {
        "db": "BID",
        "id": "104376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2018-10592",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "JPCERT/CC",
            "availabilityImpact": "Partial",
            "baseScore": 7.5,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "JVNDB-2018-003717",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 1.6,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "JPCERT/CC",
            "availabilityImpact": "Partial",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "JVNDB-2018-003717",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 1.6,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2018-10592",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.1,
            "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Network",
            "authentication": "None",
            "author": "JPCERT/CC",
            "availabilityImpact": "Complete",
            "baseScore": 9.3,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "JVNDB-2018-003717",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "High",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CNVD-2018-12136",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "IVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.2,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.9 [IVD]"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 10.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 10.0,
            "id": "VHN-120367",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "JPCERT/CC",
            "availabilityImpact": "Low",
            "baseScore": 5.3,
            "baseSeverity": "Medium",
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "JVNDB-2018-003717",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 1.6,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2018-10592",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "JPCERT/CC",
            "availabilityImpact": "High",
            "baseScore": 8.1,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2018-003717",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "JPCERT/CC",
            "availabilityImpact": "Low",
            "baseScore": 9.4,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2018-003717",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "JPCERT/CC",
            "availabilityImpact": "Low",
            "baseScore": 8.3,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2018-003717",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "JPCERT/CC",
            "id": "JVNDB-2018-003717",
            "trust": 1.6,
            "value": "High"
          },
          {
            "author": "JPCERT/CC",
            "id": "JVNDB-2018-003717",
            "trust": 1.6,
            "value": "Medium"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2018-10592",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "JPCERT/CC",
            "id": "JVNDB-2018-003717",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-12136",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201806-808",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "IVD",
            "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1",
            "trust": 0.2,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-120367",
            "trust": 0.1,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-10592",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "db": "VULHUB",
        "id": "VHN-120367"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-10592"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-10592"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution. Provided by Yokogawa Electric Corporation STARDOM There are multiple vulnerabilities in the controller. Provided by Yokogawa Electric Corporation STARDOM For small and medium-sized factories PLC Instrumentation system. STARDOM The controller contains several vulnerabilities: * * account ID And password information is hard-coded (CWE-798) - CVE-2018-10592 * * information leak (CWE-200) - CVE-2018-17900 * * Service disruption to remote management functions (DoS) (CWE-119) - CVE-2018-17902 * * Problems with hardcoded authentication information for maintenance functions (CWE-798) - CVE-2018-17896 * * Controller HTTP Service disruption to services (DoS) (CWE-119) - CVE-2018-17898The expected impact depends on each vulnerability, but can be affected as follows: * * A remote attacker can log into the controller and execute arbitrary commands - CVE-2018-10592 * * Authentication information for accessing the remote management function of the controller can be obtained by a remote third party - CVE-2018-17900 * * Remote operation by the remote party to the remote management function of the controller (DoS) Attack is done - CVE-2018-17902 * * A remote attacker logs in to the controller\u0027s maintenance function, acquires information, and falsifies - CVE-2018-17896 * * By a remote third party HTTP Service disruption to services (DoS) Attack is done - CVE-2018-17898. Yokogawa FCJ and the like are controllers used in network control systems by Yokogawa Corporation of Japan. There are security bypass vulnerabilities in various Yokogawa products. A remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service in the context of an affected device. Failed attempts will likely   cause a  denial-of-service condition. Yokogawa FCJ, etc. The following products and versions are affected: Yokogawa STARDOM FCJ R4.02 and earlier; FCN-100 R4.02 and earlier; FCN-RTU R4.02 and earlier; FCN-500 R4.02 and earlier",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-10592"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "db": "BID",
        "id": "104376"
      },
      {
        "db": "IVD",
        "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1"
      },
      {
        "db": "VULHUB",
        "id": "VHN-120367"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-10592"
      }
    ],
    "trust": 2.79
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2018-10592",
        "trust": 3.7
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-18-151-03",
        "trust": 3.5
      },
      {
        "db": "BID",
        "id": "104376",
        "trust": 2.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808",
        "trust": 0.9
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136",
        "trust": 0.8
      },
      {
        "db": "JVN",
        "id": "JVNVU92639220",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717",
        "trust": 0.8
      },
      {
        "db": "IVD",
        "id": "E2F5A10F-39AB-11E9-B112-000C29342CB1",
        "trust": 0.2
      },
      {
        "db": "VULHUB",
        "id": "VHN-120367",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-10592",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "db": "VULHUB",
        "id": "VHN-120367"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-10592"
      },
      {
        "db": "BID",
        "id": "104376"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-10592"
      }
    ]
  },
  "id": "VAR-201807-0332",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "IVD",
        "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "db": "VULHUB",
        "id": "VHN-120367"
      }
    ],
    "trust": 0.09
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS",
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      },
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.2
      }
    ],
    "sources": [
      {
        "db": "IVD",
        "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      }
    ]
  },
  "last_update_date": "2024-11-23T21:52:47.149000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "YSAR-18-0004 STARDOM \u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u306b\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u30d1\u30b9\u30ef\u30fc\u30c9\u306e\u8106\u5f31\u6027",
        "trust": 0.8,
        "url": "https://web-material3.yokogawa.com/19/6712/details/YSAR-18-0004-J.pdf"
      },
      {
        "title": "YSAR-18-0007: STARDOM\u30b3\u30f3\u30c8\u30ed\u30fc\u30e9\u306b\u8907\u6570\u306e\u8106\u5f31\u6027",
        "trust": 0.8,
        "url": "https://web-material3.yokogawa.com/YSAR-18-0007-J.jp.pdf"
      },
      {
        "title": "A variety of Yokogawa product security bypass vulnerability patches",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/132867"
      },
      {
        "title": "Multiple Yokogawa Product security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=81326"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-798",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-120367"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-10592"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.6,
        "url": "https://ics-cert.us-cert.gov/advisories/icsa-18-151-03"
      },
      {
        "trust": 2.5,
        "url": "http://www.securityfocus.com/bid/104376"
      },
      {
        "trust": 1.8,
        "url": "https://web-material3.yokogawa.com/1/6712/details/ysar-18-0004-e.pdf"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17900"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17902"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17896"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17898"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10592"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu92639220/"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-17900"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-17902"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-10592"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-17896"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-17898"
      },
      {
        "trust": 0.3,
        "url": "https://web-material3.yokogawa.com/1/6712/details/ysar-18-0004-e.pdf?_ga=2.1690613.59816134.1528173701-1842584293.1528173701"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/798.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "db": "VULHUB",
        "id": "VHN-120367"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-10592"
      },
      {
        "db": "BID",
        "id": "104376"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-10592"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "IVD",
        "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "db": "VULHUB",
        "id": "VHN-120367"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-10592"
      },
      {
        "db": "BID",
        "id": "104376"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-10592"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-06-27T00:00:00",
        "db": "IVD",
        "id": "e2f5a10f-39ab-11e9-b112-000c29342cb1"
      },
      {
        "date": "2018-06-27T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "date": "2018-07-31T00:00:00",
        "db": "VULHUB",
        "id": "VHN-120367"
      },
      {
        "date": "2018-07-31T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-10592"
      },
      {
        "date": "2018-05-31T00:00:00",
        "db": "BID",
        "id": "104376"
      },
      {
        "date": "2018-06-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "date": "2018-06-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      },
      {
        "date": "2018-07-31T17:29:00.233000",
        "db": "NVD",
        "id": "CVE-2018-10592"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-06-27T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-12136"
      },
      {
        "date": "2019-10-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-120367"
      },
      {
        "date": "2019-10-09T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-10592"
      },
      {
        "date": "2018-05-31T00:00:00",
        "db": "BID",
        "id": "104376"
      },
      {
        "date": "2019-07-24T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      },
      {
        "date": "2024-11-21T03:41:37.347000",
        "db": "NVD",
        "id": "CVE-2018-10592"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "STARDOM Multiple vulnerabilities in controller",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-003717"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "trust management problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201806-808"
      }
    ],
    "trust": 0.6
  }
}

CVE-2018-10592 (GCVE-0-2018-10592)

Vulnerability from cvelistv5 – Published: 2018-07-31 17:00 – Updated: 2024-09-16 17:38

Summary

Severity

No CVSS data available.

CWE

CWE-798 - USE OF HARD-CODED CREDENTIALS CWE-798

Assigner

icscert CNA under the icscert root

CNA scorecard B 75/100 over 351 records in the last 180 days details

References

3 references

URL	Tags
https://web-material3.yokogawa.com/1/6712/details…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/104376	vdb-entryx_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03	x_refsource_MISC

Impacted products

4 products

Vendor	Product	Version
Yokogawa	STARDOM FCJ Controllers	Affected: R4.02 and prior
Yokogawa	STARDOM FCN-100 Controllers	Affected: R4.02 and prior
Yokogawa	STARDOM FCN-RTU Controllers	Affected: R4.02 and prior
Yokogawa	STARDOM FCN-500 Controllers	Affected: R4.02 and prior

Date Public

2018-05-31 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:39:08.364Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://web-material3.yokogawa.com/1/6712/details/YSAR-18-0004-E.pdf"
          },
          {
            "name": "104376",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104376"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "STARDOM FCJ Controllers",
          "vendor": "Yokogawa",
          "versions": [
            {
              "status": "affected",
              "version": "R4.02 and prior"
            }
          ]
        },
        {
          "product": "STARDOM FCN-100 Controllers",
          "vendor": "Yokogawa",
          "versions": [
            {
              "status": "affected",
              "version": "R4.02 and prior"
            }
          ]
        },
        {
          "product": "STARDOM FCN-RTU Controllers",
          "vendor": "Yokogawa",
          "versions": [
            {
              "status": "affected",
              "version": "R4.02 and prior"
            }
          ]
        },
        {
          "product": "STARDOM FCN-500 Controllers",
          "vendor": "Yokogawa",
          "versions": [
            {
              "status": "affected",
              "version": "R4.02 and prior"
            }
          ]
        }
      ],
      "datePublic": "2018-05-31T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "USE OF HARD-CODED CREDENTIALS CWE-798",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-01T09:57:01.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://web-material3.yokogawa.com/1/6712/details/YSAR-18-0004-E.pdf"
        },
        {
          "name": "104376",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104376"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2018-05-31T00:00:00",
          "ID": "CVE-2018-10592",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "STARDOM FCJ Controllers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "R4.02 and prior"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "STARDOM FCN-100 Controllers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "R4.02 and prior"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "STARDOM FCN-RTU Controllers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "R4.02 and prior"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "STARDOM FCN-500 Controllers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "R4.02 and prior"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yokogawa"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "USE OF HARD-CODED CREDENTIALS CWE-798"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://web-material3.yokogawa.com/1/6712/details/YSAR-18-0004-E.pdf",
              "refsource": "CONFIRM",
              "url": "https://web-material3.yokogawa.com/1/6712/details/YSAR-18-0004-E.pdf"
            },
            {
              "name": "104376",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104376"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-10592",
    "datePublished": "2018-07-31T17:00:00.000Z",
    "dateReserved": "2018-05-01T00:00:00.000Z",
    "dateUpdated": "2024-09-16T17:38:31.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted