CVE-2019-6008

🗓️ 26 Dec 2019 15:16:49Reported by jpcertType

Unquoted search path vulnerability in Yokogawa products for Windows, allowing local users to gain privileges via a malicious executable fil

Reporter	Title	Published	Views	Family All 9
BDU FSTEC	Vulnerabilities of the OPC server Exaopc, the statistical information processing software package Exaplog, the production data management system Exaquantum, the data analysis software Exaquantum/Batch, the set of software packages for multi-parameter optimization and management Exasmoc, the quality assessment software Exarqe, the data storage software with additional features GA10, the performance reporting software InsightSuiteAE. The vulnerability exists because the path to the executable file of the service is not enclosed in quotes and contains spaces, allowing attackers to exploit their privileges and execute arbitrary code.	27 Sep 201900:00	–	bdu_fstec
Circl	CVE-2019-6008	17 Mar 202409:17	–	circl
CVE	CVE-2019-6008	26 Dec 201915:16	–	cve
EUVD	EUVD-2019-15576	7 Oct 202500:30	–	euvd
ICS	Yokogawa Products	1 Oct 201900:00	–	ics
NVD	CVE-2019-6008	26 Dec 201916:15	–	nvd
OSV	CVE-2019-6008	26 Dec 201916:15	–	osv
Prion	Design/Logic Flaw	26 Dec 201916:15	–	prion
RedhatCVE	CVE-2019-6008	22 May 202505:21	–	redhatcve

[
  {
    "product": "Multiple Yokogawa products for Windows",
    "vendor": "Yokogawa Electric Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Exaopc (R1.01.00 ? R3.77.00), Exaplog (R1.10.00 ? R3.40.00), Exaquantum (R1.10.00 ? R3.02.00 and  R3.15.00), Exaquantum/Batch (R1.01.00 ? R2.50.40), Exasmoc (all revisions), Exarqe (all revisions), GA10 (R1.01.01 ? R3.05.01), and InsightSuiteAE (R1.01.00 ? R1.06.00)"
      }
    ]
  }
]

Source	Link
yokogawa	www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/
jvn	www.jvn.jp/vu/JVNVU98228725/index.html

26 Dec 2019 15:16Current

8High risk

Vulners AI Score8

EPSS0.0126