« Volver al listado

CVE-2016-4860

Estado: ModificadaAlta (7.3)—

Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify application command.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Yokogawa — Stardom Fcn/fcj

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-4860",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2016-09-19T01:59:03.837",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/92981",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-259-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://web-material3.yokogawa.com/YSAR-16-0002-E.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "http://www.securityfocus.com/bid/92981",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-16-259-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://web-material3.yokogawa.com/YSAR-16-0002-E.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Yokogawa STARDOM FCN/FCJ controller R1.01 through R4.01 does not require authentication for Logic Designer connections, which allows remote attackers to reconfigure the device or cause a denial of service via a (1) stop application program, (2) change value, or (3) modify application command."
    },
    {
      "lang": "es",
      "value": "El controlador Yokogawa STARDOM FCN/FCJ R1.01 hasta la versión R4.01 no requiere autenticación para conexiones Logic Designer, lo que permite a atacantes remotos reconfigurar el dispositivo o provocar una denegación de servicio a través de (1) un programa de detención de aplicación, (2) un valor de cambio o (3) un comando de modificación de aplicación."
    }
  ],
  "lastModified": "2026-06-17T00:48:20.867",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yokogawa:stardom_fcn\\/fcj:r1.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B60EF541-5948-4E40-A80D-E00D15C2444C"
            },
            {
              "criteria": "cpe:2.3:a:yokogawa:stardom_fcn\\/fcj:r2.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E14BD32F-6513-47AC-A0A9-A84414B0232D"
            },
            {
              "criteria": "cpe:2.3:a:yokogawa:stardom_fcn\\/fcj:r3.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "870BA36D-077E-4D91-9D41-8D7C8F6A726E"
            },
            {
              "criteria": "cpe:2.3:a:yokogawa:stardom_fcn\\/fcj:r4.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AC194BE-CD21-473E-A735-A00346EC1661"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}