Yokogawa FAST/TOOLS HSTS Configuration Vulnerability Allowing Man-in-the-Middle Attacks

A vulnerability exists in Yokogawa FAST/TOOLS versions R9.01 to R10.04, across several packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. The issue stems from the lack of HTTP Strict Transport Security (HSTS) configuration, which leaves communications with the web server vulnerable to interception during a man-in-the-middle (MITM) attack.

Impact

Exploitation of this vulnerability could lead to interception and sniffing of communications with the web server, allowing an attacker to potentially capture sensitive information or manipulate data in transit.

Remediation

Users are advised to update to FAST/TOOLS R10.04 SP3 and apply the patch software CS_e12787. For assistance, contact your local Yokogawa supporting office.