CVE-2018-17898

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Yokogawa STARDOM Controllers FCJ,FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The controller application fails to prevent memory exhaustion by unauthorized requests. This could allow an attacker to cause the controller to become unstable.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Yokogawa	STARDOM Controllers FCJ,FCN-100,FCN-RTU, FCN-500	All versions R4.10 and prior

References

https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03Third Party Advisory, US Government Resource
https://web-material3.yokogawa.com/YSAR-18-0007-E.pdfVendor Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-151-03Third Party Advisory, US Government Resource
https://web-material3.yokogawa.com/YSAR-18-0007-E.pdfVendor Advisory

Timeline

Published: Oct 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-178998.8LAquis SCADA Versions 4.1.0.3870 and prior has a path traversal vulnerability, which may allow remote code execution.CVE-2018-17908.8IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allo CVE-2018-179009.8Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The web application improperly protects credentia CVE-2018-179017.8LAquis SCADA Versions 4.1.0.3870 and prior, when processing project files the application fails to sanitize user input prior to performing w CVE-2018-179025.3Yokogawa STARDOM Controllers FCJ, FCN-100, FCN-RTU, FCN-500, All versions R4.10 and prior, The application utilizes multiple methods of sess CVE-2018-179039.1SAGA1-L8B with any firmware versions prior to A0.10 are vulnerable to a replay attack and command forgery.CVE-2018-179046.1Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code.CVE-2018-179057.8When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with a specific byte, memory corruption may oc CVE-2018-179068.8Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authenticatio CVE-2018-179073.3When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior and tampering with the value of an offset, an attacker can f CVE-2018-179087.8WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it af CVE-2018-179097.8When processing project files in Omron CX-Supervisor Versions 3.4.1.0 and prior, the application fails to check if it is referencing freed m