CVE-2022-30997
📋 TL;DR
This vulnerability involves hard-coded credentials in STARDOM FCN and FCJ controllers, allowing attackers with administrative access to read/change configuration settings or install tampered firmware. It affects industrial control systems running versions R4.10 through R4.31 of these controllers.
💻 Affected Systems
- STARDOM FCN Controller
- STARDOM FCJ Controller
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to operational disruption, safety incidents, or physical damage through malicious firmware updates.
Likely Case
Unauthorized configuration changes leading to operational issues, data theft, or preparation for further attacks.
If Mitigated
Limited impact if network segmentation and access controls prevent administrative access to controllers.
🎯 Exploit Status
Exploitation requires administrative access to the controller, but once obtained, using hard-coded credentials is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: R4.32 or later
Vendor Advisory: https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf
Restart Required: Yes
Instructions:
1. Download firmware version R4.32 or later from Yokogawa support. 2. Backup current configuration. 3. Apply firmware update following vendor instructions. 4. Verify update and restore configuration if needed.
🔧 Temporary Workarounds
Network segmentation
allIsolate controllers from untrusted networks and limit administrative access.
Access control hardening
allImplement strict firewall rules and multi-factor authentication for administrative interfaces.
🧯 If You Can't Patch
- Implement network segmentation to isolate controllers from untrusted networks.
- Monitor for unauthorized access attempts and configuration changes.
🔍 How to Verify
Check if Vulnerable:
Check controller firmware version via web interface or CLI. If version is between R4.10 and R4.31, it is vulnerable.Check Version:
Check via controller web interface or vendor-specific CLI commands (varies by model).Verify Fix Applied:
Verify firmware version is R4.32 or later after applying update.📡 Detection & Monitoring
Log Indicators:
- Unauthorized login attempts using default/hard-coded credentials
- Unexpected configuration changes
- Firmware update events
Network Indicators:
- Unusual administrative access patterns to controller interfaces
- Traffic to/from controller on administrative ports
SIEM Query:
source="controller_logs" AND (event_type="login_failure" OR event_type="config_change" OR event_type="firmware_update")🔗 References
- https://jvn.jp/vu/JVNVU95452299/index.html
- https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf
- https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01
- https://jvn.jp/vu/JVNVU95452299/index.html
- https://web-material3.yokogawa.com/1/32885/files/YSAR-22-0007-E.pdf
- https://web-material3.yokogawa.com/19/32885/files/YSAR-22-0007-J.pdf
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-01
