JVN#84094853
PALLET CONTROL products vulnerable to improper access control

Overview

PALLET CONTROL products provided by JAL Information Technology Co., Ltd. contains an improper access control vulnerability.

Products Affected

• PALLET CONTROL Ver. 6.3 patch 5 and ealier
• PalletControl 10 Update 8 and earlier
• PalletControl Cloud (PalletControl 10 Update 8) and earlier

Description

PALLET CONTROL products provided by JAL Information Technology Co., Ltd. include multiple service programs that run in the background and provide certain functions. However, access to these service programs is not properly restricted, allowing non-administrative users to access them.

• Improper access control in interprocess communication (CWE-276)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.5
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2026-81302

Impact

An attacker who can log in to a Windows client where the affected product is installed may execute arbitrary code with SYSTEM privileges.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.
The developer has released the following versions to fix the vulnerability.

• PALLET CONTROL Ver. 6.3 patch 6 or later
• PalletControl 10 Update 9 or later
• PalletControl Cloud (PalletControl 10 Update 9) or later