dbcve.org
Stardom Fcj FirmwareOperating system · Yokogawa

CVE-2023-5915

MEDIUM · 5.3 CVSS v3.1 Published 2023-12-01
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
62/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller’s operation is not stopped by the condition. The affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The STARDOM FCN/FCJ controller (versions R1.01-R4.31) has an uncontrolled resource consumption vulnerability where a remote attacker sending a crafted packet can cause a denial-of-service condition. This renders the maintenance homepage inaccessible and prevents configuration changes and log viewing, though the controller's core operation continues.

MitigationUpdate STARDOM FCN/FCJ to a patched version beyond R4.31; until patch is applied, implement network segmentation and firewall controls to restrict unauthorized access to the controller.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Stardom Fcj FirmwareOperating system
Affected:>= r1.01, <= r4.31
Stardom Fcn FirmwareOperating system
Affected:>= r1.01, <= r4.31

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm STARDOM controller model
    Access the controller's web interface or check the device nameplate/documentation to verify the model is either FCN or FCJ.
    Affected if The device is not an FCN or FCJ model - this CVE only affects those specific controllers.
  2. Locate firmware version information
    Access the controller's web-based management interface and navigate to the system information, about page, or firmware version display. The version is typically shown in the maintenance or diagnostics section.
    Affected if Unable to retrieve firmware version - version must be confirmed to determine if it falls within the affected range.
  3. Verify firmware version is in affected range
    Compare the installed firmware version against the affected range: R1.01 through R4.31 inclusive.
    Affected if Firmware version is R1.01, R1.02, R1.03, R2.x, R3.x, or R4.x through R4.31 - these versions are vulnerable.
  4. Assess network exposure
    Determine if the controller's management interface (HTTP/HTTPS ports) is accessible from untrusted networks. Check firewall rules, network segmentation, and ACLs surrounding the controller.
    Affected if Controller is directly accessible from the internet or untrusted networks without firewall protection - this is required for remote exploitation.

You are affected if you have a STARDOM FCN or FCJ controller running firmware version R1.01 through R4.31 with its management interface accessible to untrusted network segments.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Update STARDOM FCN/FCJ to a patched version beyond R4.31; until patch is applied, implement network segmentation and firewall controls to restrict unauthorized access to the controller.

Recommended fix Moderate confidence

R4.32 or later (firmware version newer than R4.31)

  1. 1. Identify the current firmware version of the STARDOM FCN/FCJ controller by accessing the maintenance homepage or checking system documentation.
  2. 2. Download the firmware update package from the official Yokogawa support website (web-material3.yokogawa.com) or contact Yokogawa technical support to obtain the fixed firmware version.
  3. 3. Review the firmware upgrade procedure in the STARDOM FCN/FCJ product manual to understand prerequisites and safety considerations.
  4. 4. Create a backup of the current controller configuration as recommended in the product documentation.
  5. 5. Perform the firmware upgrade following Yokogawa's official upgrade procedure, ensuring stable power supply during the process.
  6. 6. After upgrade, verify the new firmware version matches the fixed release (R4.32 or later).
  7. 7. Confirm the maintenance homepage is accessible and the vulnerability is mitigated by testing access to configuration, logs, and other maintenance functions.
Caveat Review Yokogawa release notes for any configuration or functionality changes between R4.31 and the target fixed version

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Stardom Fcj Firmware Scoped from the published advisory
  • Consultation4.0 h
  • Implementation6.0 h
  • Testing8.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,800
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,080.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-5915 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-5915 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data