CVE-2023-5915

A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. This vulnerability may allow to a remote attacker to cause a denial-of-service condition to the FCN/FCJ controller by sending a crafted packet. While sending the packet, the maintenance homepage of the controller could not be accessed. Therefore, functions of the maintenance homepage, changing configuration, viewing logs, etc. are not available. But the controller’s operation is not stopped by the condition. The affected products and versions are as follows: STARDOM FCN/FCJ R1.01 to R4.31.

Published: 2023-12-01 Last update: 2026-06-17 Assigner: 7168b535-132a-4efe-a076-338f829b2eb9 Source: 7168b535-132a-4efe-a076-338f829b2eb9
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2023-5915 is rated Moderate Risk (44/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 1.17%). Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2023-5915

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.43% 1.17% +0.74%
2 2025-11-21 0.33% 0.43% +0.10%
3 2025-11-18 — 0.33% —

Full EPSS history (11 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2023-5915

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.3 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.
 3.9 1.4 [email protected]

Weakness enumeration for CVE-2023-5915

Affected software / configurations for CVE-2023-5915

Vendor Product Version Raw CPE
yokogawa stardom_fcj_firmware >= r1.01, <= r4.31 cpe:2.3:o:yokogawa:stardom_fcj_firmware:*:*:*:*:*:*:*:*
yokogawa stardom_fcn_firmware >= r1.01, <= r4.31 cpe:2.3:o:yokogawa:stardom_fcn_firmware:*:*:*:*:*:*:*:*

References for CVE-2023-5915

URL Tags
https://jvn.jp/vu/JVNVU95177889/index.html Mitigation Third Party Advisory
https://web-material3.yokogawa.com/1/35463/files/YSAR-23-0003-E.pdf Mitigation Vendor Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-334-02 Mitigation Third Party Advisory US Government Resource
cvelogic Threat Intelligence