« Volver al listado

CVE-2014-7251

Estado: ModificadaBaja (3.2)—

XML external entity (XXE) vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service (CPU or network traffic consumption) or read arbitrary files via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yokogawa — Fast/tools

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-7251",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.1,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-12-06T15:59:06.060",
  "references": [
    {
      "url": "http://jvn.jp/en/jp/JVN54775800/index.html",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000141.html",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0004E.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99018",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://jvn.jp/en/jp/JVN54775800/index.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-000141.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0004E.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99018",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "XML external entity (XXE) vulnerability in the WebHMI server in Yokogawa Electric Corporation FAST/TOOLS before R9.05-SP2 allows local users to cause a denial of service (CPU or network traffic consumption) or read arbitrary files via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de entidad externa XML (XXE) en el servidor WebHMI en Yokogawa Electric Corporation FAST/TOOLS anterior a R9.05-SP2 permite a usuarios locales causar una denegación de servicio (consumo de CPU o trafico de red) o leer ficheros arbitrarios a través de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:14:37.973",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yokogawa:fast\\/tools:r9.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B76A65DE-E15A-470B-8AF8-2914CEE5DDEE"
            },
            {
              "criteria": "cpe:2.3:a:yokogawa:fast\\/tools:r9.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FF949B9-7DF6-4BEB-AC6F-CB291A777452"
            },
            {
              "criteria": "cpe:2.3:a:yokogawa:fast\\/tools:r9.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94FEFEA4-DA82-49D3-B6C1-21B2D8956532"
            },
            {
              "criteria": "cpe:2.3:a:yokogawa:fast\\/tools:r9.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52406155-A891-4E05-A558-AC79FF9CAF27"
            },
            {
              "criteria": "cpe:2.3:a:yokogawa:fast\\/tools:r9.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C897163D-72A2-481A-9E06-EC7F409A6833"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}