The vulnerability resides in the web server component of Yokogawa FAST/TOOLS and CI Server, whereby it may return a response containing CI Server setting information. This information, considered sensitive, could be accessed by unauthenticated users and exploited for subsequent attacks, such as configuration tampering or unauthorized access. The weakness is categorized as insecure transmission of information (CWE‑319), leading to possible confidentiality compromise.

Affected vendors include Yokogawa Electric Corporation. The product families impacted are FAST/TOOLS, specifically the packages RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB with versions ranging from R9.01 to R10.04, and CI Server for all packages with versions R1.01 to R1.04.

The vulnerability is assigned a CVSS score of 8.2, indicating high severity. EPSS data is unavailable, so the exact probability of exploitation is unknown, but the lack of KEV listing suggests no confirmed exploitation yet. The likely attack vector is remote through the HTTP/HTTPS interface of the web server, providing an attacker unauthenticated access to configuration information.