Yokogawa FAST/TOOLS Improper URL Encoding Vulnerability Allowing Web Page Tampering and Script Execution

A vulnerability exists in Yokogawa FAST/TOOLS versions R9.01 to R10.04, across several packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. The issue stems from improper URL encoding, which could enable an attacker to manipulate web pages or execute malicious scripts.

Impact

Exploitation of this vulnerability could lead to Cross-Site Scripting (XSS) attacks, allowing for the execution of malicious scripts in the context of the user's browser.

Remediation

Users are advised to update to FAST/TOOLS R10.04 SP3 and apply the patch software CS_e12787. For assistance, contact your local Yokogawa supporting office.