CVE-2022-29519

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Yokogawa Electric Corporation	STARDOM Controller	STARDOM FCN Controller and FCJ Controller R1.01 to R4.31

References

https://jvn.jp/vu/JVNVU95452299/index.htmlMitigation, Third Party Advisory, VDB Entry
https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdfMitigation, Vendor Advisory
https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdfMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01Mitigation, Third Party Advisory, US Government Resource
https://jvn.jp/vu/JVNVU95452299/index.htmlMitigation, Third Party Advisory, VDB Entry
https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdfMitigation, Vendor Advisory
https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdfMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jun 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-29527.8GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionCon CVE-2022-295209.8An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit CVE-2022-295227.8Use after free vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may al CVE-2022-295235.5Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authenticated user to potential CVE-2022-295247.8Out-of-bounds write vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attac CVE-2022-295259.8Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in wit CVE-2022-295265.3Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat fu CVE-2022-295277.0Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and e CVE-2022-295289.8An issue was discovered in MISP before 2.4.158. PHAR deserialization can occur.CVE-2022-295295.4An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.CVE-2022-29535.5LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection in tools/tiffcrop.c:6905, allowing attackers to cause a denial-of-service via CVE-2022-295305.4An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.