by Kastro
Paper/Archive/CVE-2024-36246

CVE-2024-36246

Yokogawa Rental & Lease Corporation Unifier — Missing authorization vulnerability exists in Unifier and Unifier Cast.

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.8.458 × 209.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Missing authorization vulnerability exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted.

Affected

ProductAffectedFixed inSource
UnifierVersion.5.0 or later but prior to v5.10.6–CNA
Unifierand the patch "20240527" not applied–CNA
Unifier CastVersion.5.0 or later but prior to v5.10.6–CNA
Unifier Castand the patch "20240527" not applied–CNA
Unifier CastVersion.6.0 or later but prior to v6.5.0–CNA
Unifier Castand the patch "20240527" not applied–CNA
unifier5.0–CISA-ADP
unifier_cast5.0–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
jpcert (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refyrl.com/fwp_support/info/khvu7f00000000q7.htmlrefyrl.com/fwp_support/info/khvu7f00000007j8.htmlrefyrl.com/fwp_support/info/khvu7f0000000auf.htmlrefjvn.jp/en/jp/JVN17680667