CVE-2018-17900
📋 TL;DR
This vulnerability in Yokogawa STARDOM Controllers allows attackers to obtain credentials due to improper protection in the web application. Attackers can use these credentials for remote access to industrial controllers. Affected systems include FCJ, FCN-100, FCN-RTU, and FCN-500 controllers running version R4.10 and earlier.
💻 Affected Systems
- STARDOM FCJ
- STARDOM FCN-100
- STARDOM FCN-RTU
- STARDOM FCN-500
📦 What is this software?
Fcj Firmware by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems allowing attackers to manipulate processes, cause physical damage, or disrupt critical infrastructure operations.
Likely Case
Unauthorized access to controller systems enabling data theft, configuration changes, or disruption of industrial processes.
If Mitigated
Limited impact with proper network segmentation and access controls preventing credential harvesting and controller access.
🎯 Exploit Status
Credential exposure vulnerability that doesn't require authentication to exploit. Attackers can harvest credentials from improperly protected web application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: R4.11 and later
Vendor Advisory: https://web-material3.yokogawa.com/YSAR-18-0007-E.pdf
Restart Required: Yes
Instructions:
1. Download firmware update R4.11 or later from Yokogawa support portal. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Restart controller. 5. Verify firmware version and functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate controllers from untrusted networks and restrict access to web interface.
Disable Web Interface
allDisable the vulnerable web application if not required for operations.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate controllers from untrusted networks
- Deploy network monitoring and intrusion detection for credential harvesting attempts
🔍 How to Verify
Check if Vulnerable:
Check controller firmware version via web interface or management console. If version is R4.10 or earlier, system is vulnerable.Check Version:
Check via controller web interface or use vendor-specific management tools to query firmware version.Verify Fix Applied:
Verify firmware version is R4.11 or later. Test that credentials are no longer exposed through web application.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts
- Unusual access patterns to web interface
- Credential harvesting attempts
Network Indicators:
- Unusual traffic to controller web ports
- Credential extraction patterns in HTTP traffic
SIEM Query:
source_ip=controller_ips AND (http_method=GET AND uri_contains='credential' OR 'password') OR (failed_auth > threshold)