CVE-2019-6008
An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ?
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ? R3.77.00), Exaplog (R1.10.00 ? R3.40.00), Exaquantum (R1.10.00 ? R3.02.00 and R3.15.00), Exaquantum/Batch (R1.01.00 ? R2.50.40), Exasmoc (all revisions), Exarqe (all revisions), GA10 (R1.01.01 ? R3.05.01), and InsightSuiteAE (R1.01.00 ? R1.06.00)) allow local users to gain privileges via a Trojan horse executable file and execute arbitrary code with eleveted privileges.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.26% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-428
- Affected
- yokogawa/exaopc · yokogawa/exaplog · yokogawa/exaquantum · yokogawa/exaquantum\/batch · yokogawa/exarqe · yokogawa/exasmoc · yokogawa/ga10 · yokogawa/insightsuiteae
- Source
- vultures@jpcert.or.jp
References
- http://jvn.jp/vu/JVNVU98228725/index.htmlThird Party Advisory
- https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/Vendor Advisory
- http://jvn.jp/vu/JVNVU98228725/index.htmlThird Party Advisory
- https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.