CyberSecBulletin
CVE-2024-8110NVD status: Deferred

Dual-redundant Platform for Computer (PC2CKM): Unchecked Return Value

Published Updated By the CyberSecBulletin desk

CVE-2024-8110 is a high-severity unchecked return value vulnerability in Dual-redundant Platform for Computer (PC2CKM) from Yokogawa Electric, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected Dual-redundant Platform for Computer (PC2CKM) versions: R1.01.00 through R2.03.00. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.43% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Check which version of Dual-redundant Platform for Computer (PC2CKM) you run against the affected versions below, and install the vendor's latest release.
  2. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
Yokogawa ElectricDual-redundant Platform for Computer (PC2CKM)R1.01.00 through R2.03.00Not stated
Yokogawadual-redundant_platform_for_computer_\(pc2ckm\)r1.01.00 through r2.03.00Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by CNA.

Official description

Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer. If a computer on which the affected product is installed receives a large number of UDP broadcast packets in a short period, occasionally that computer may restart. If both the active and standby computers are restarted at the same time, the functionality on that computer may be temporarily unavailable.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Unchecked Return Value

The product does not check the return value from a method or function.

How developers prevent this class of flaw

  • Check the results of all functions that return a value and verify that the value is expected.
  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Ensure that you account for all possible return values from the function.

More Unchecked Return Value vulnerabilities (CWE-252)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Unchecked Return Value vulnerabilities

Spotted an error? Tell us.