TI-2024-03825 Aliases CVE-2024-4106 GHSA-7wqc-7vpc-67h3

A vulnerability has been found in FAST/TOOLS and CI Server.

LOW 30CWE-258Published 2024-06-26 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability has been found in FAST/TOOLS and CI Server. The affected products have built-in accounts with no passwords set. Therefore, if the product is operated without a password set by default, an attacker can break into the affected product. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04 CI Server R1.01.00 to R1.03.00

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00393 33rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Yokogawa Electric Corporation	FAST/TOOLS	R9.01 – R10.04	—	No fix listed	CNA
Yokogawa Electric Corporation	CI Server	R1.01.00 – R1.03.00	—	No fix listed	CNA

FAST/TOOLS VendorYokogawa Electric Corporation Affected R9.01 – R10.04 Fixed in — No fix listed CNA
CI Server VendorYokogawa Electric Corporation Affected R1.01.00 – R1.03.00 Fixed in — No fix listed CNA

CPE names CISA-ADP · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:yokogawa_electric_corporation:fast_tools:r901:::::::*	r901	—	—
cpe:2.3:a:yokogawa_electric_corporation:ci_server:r1.01.00:::::::*	r1.01.00	—	—

cpe:2.3:a:yokogawa_electric_corporation:fast_tools:r901:*:*:*:*:*:*:* Versions r901 — ·—
cpe:2.3:a:yokogawa_electric_corporation:ci_server:r1.01.00:*:*:*:*:*:*:* Versions r1.01.00 — ·—

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2024-06-26
Yokogawa Electric CI Server, FAST/TOOLS — web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2024-03824 Cross-site scripting in Yokogawa Electric Corporation FAST/TOOLSPriority LOW 27
Show all 2 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-4106
2026-10-03 Alias added: GHSA-7wqc-7vpc-67h3

References

Advisory 1

https://web-material3.yokogawa.com/1/36059/files/YSAR-24-0001-E.pdf

TI-2014-00729 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow CVSS 2.0CRITICAL 9.0
TI-2014-03162 Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000… CVSS 2.0HIGH 8.3
TI-2014-00728 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow CVSS 2.0HIGH 8.3
TI-2014-00730 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow CVSS 2.0HIGH 8.3
TI-2014-00727 Yokogawa CENTUM CS 3000 Heap-based Buffer Overflow CVSS 2.0CRITICAL 9.3
TI-2014-04257 BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50… CVSS 2.0HIGH 7.5

See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences