CVE-2022-30997

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Yokogawa Electric Corporation	STARDOM Controller	STARDOM FCN Controller and FCJ Controller R4.10 to R4.31
yokogawa	stardom_fcj_firmware	>= r4.10, <= r4.31
yokogawa	stardom_fcn_firmware	>= r4.10, <= r4.31

References

https://jvn.jp/vu/JVNVU95452299/index.htmlMitigation, Third Party Advisory, VDB Entry
https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdfMitigation, Vendor Advisory
https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdfMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01Mitigation, Third Party Advisory, US Government Resource
https://jvn.jp/vu/JVNVU95452299/index.htmlMitigation, Third Party Advisory, VDB Entry
https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdfMitigation, Vendor Advisory
https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdfMitigation, Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jun 28, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-309988.8Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer f CVE-2022-309995.4FriendsofFlarum (FoF) Upload is an extension that handles file uploads intelligently for your forum. If FoF Upload prior to version 1.2.3 is CVE-2022-31005.9A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.CVE-2022-310004.3solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-sit CVE-2022-310017.5Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message wi CVE-2022-310027.5Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message wi CVE-2022-310039.8Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp m CVE-2022-310047.5CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for product CVE-2022-310057.5Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer ov CVE-2022-310067.5indy-node is the server portion of Hyperledger Indy, a distributed ledger purpose-built for decentralized identity. In vulnerable versions o CVE-2022-310077.2eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with CVE-2022-310087.5RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation