JVN#17680667
Multiple vulnerabilities in Unifier and Unifier Cast

Overview

Unifier and Unifier Cast provided by Yokogawa Rental ＆ Lease Corporation contains multiple vulnerabilities.

Products Affected

• Unifier Version.5.0 or later but prior to v5.10.6, and the patch "20240527" not applied
• Unifier Cast Version.5.0 or later but prior to v5.10.6, and the patch "20240527" not applied
• Unifier Cast Version.6.0 or later but prior to v6.5.0, and the patch "20240527" not applied

Description

Unifier and Unifier Cast provided by Yokogawa Rental ＆ Lease Corporation contains multiple vulnerabilities listed below.

• Incorrect Default Permissions configured by Cast Launcher (CWE-276)
  • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8
  • CVE-2024-23847
• Missing Authorization for coejobhook Command Execution (CWE-862)
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
  • CVE-2024-36246

Impact

An arbitrary code may be executed with LocalSystem privilege.
As a result, a malicious program may be installed, data may be modified or deleted.

Solution

Update the Software or Apply the patch
Update the software to the latest version or apply the patch according to the information provided by the developer.

For more information, refer to the information provided by the developer.