JVN#17680667
Multiple vulnerabilities in Unifier and Unifier Cast

Overview

Unifier and Unifier Cast provided by Yokogawa Rental ＆ Lease Corporation contains multiple vulnerabilities.

Products Affected

• Unifier Version.5.0 or later, and the patch "20240527" not applied
• Unifier Cast Version.5.0 or later, and the patch "20240527" not applied

Description

Unifier and Unifier Cast provided by Yokogawa Rental ＆ Lease Corporation contains multiple vulnerabilities listed below.

• Incorrect Default Permissions configured by Cast Launcher (CWE-276)
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2024-23847
• Missing Authorization for coejobhook Command Execution (CWE-862)
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2024-36246

Impact

An arbitrary code may be executed with LocalSystem privilege.
As a result, a malicious program may be installed, data may be modified or deleted.

Solution

Apply the patch
Apply the patch according to the information provided by the developer.

For more information, refer to the information provided by the developer.