Incorrect default permissions issue exists in Unifier and Unifier Cast. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be altered or deleted.

Incorrect default permissions issue exists in Unifier and Unifier Cast Version.5.0 or later, and the patch "20240527" not applied. If this vulnerability is exploited, arbitrary code may be executed with LocalSystem privilege. As a result, a malicious program may be installed, data may be modified or deleted.

Unifier and Unifier Cast provided by Yokogawa Rental & Lease Corporation contains multiple vulnerabilities listed below. <ul> <li><b>Incorrect Default Permissions configured by Cast Launcher (<a href="https://cwe.mitre.org/data/definitions/276.html">CWE-276</a>)</b> - CVE-2024-23847 </li> <li><b>Missing Authorization for coejobhook Command Execution (<a href="https://cwe.mitre.org/data/definitions/862.html">CWE-862</a>)</b> - CVE-2024-36246 </li> </ul> CVE-2024-23847 Yokogawa Rental & Lease Corporation reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and Yokogawa Rental & Lease Corporation coordinated under the Information Security Early Warning Partnership. CVE-2024-36246 Taisei Ogura of MOTEX Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.