[Japanese]

JVNDB-2026-000126

PALLET CONTROL products vulnerable to improper access control

Overview

PALLET CONTROL products provided by JAL Information Technology Co., Ltd. include multiple service programs that run in the background and provide certain functions. However, access to these service programs is not properly restricted, allowing non-administrative users to access them.
  • Improper access control in interprocess communication (CWE-276) - CVE-2026-81302
Hiromichi Kurosu and Masatsugu Ueda of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V3 Severity:
Base Metrics 7.8 (High) [IPA Score]
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
CVSS v4 Severity
Base Metrics: 8.5 (High) [IPA Score]
  • Access Vector (AV): Local
  • Attack Complexity (AC): Low
  • Attack Requirements (AT): None
  • Privileges Required (PR): Low
  • User Interaction (UI): None
    • Vulnerable System Impact
  • Confidentiality Impact (VC): High
  • Integrity Impact (VI): High
  • Availability Impact (VA): High
    • Subsequent System Impact
  • Confidentiality Impact (SC): None
  • Integrity Impact (SI): None
  • Availability Impact (SA): None
Affected Products


JAL Digital Co.,Ltd.
  • PALLET CONTROL Ver. 6.3 patch 5 and ealier
  • PalletControl 10 Update 8 and earlier
  • PalletControl Cloud (PalletControl 10 Update 8) and earlier

Impact

An attacker who can log in to a Windows client where the affected product is installed may execute arbitrary code with SYSTEM privileges.
Solution

[Update the Software]
Update the software to the latest version according to the information provided by the developer.
The developer has released the following versions to fix the vulnerability.
  • PALLET CONTROL Ver. 6.3 patch 6 or later
  • PalletControl 10 Update 9 or later
  • PalletControl Cloud (PalletControl 10 Update 9) or later
Vendor Information

JAL Digital Co.,Ltd.
CWE (What is CWE?)

  1. No Mapping(CWE-Other) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2026-81302
References

  1. JVN : JVN#84094853
Revision History

  • [2026/09/01]
      Web page was published

Date Public2026/09/01
Date First Published2026/09/01
Date Last Updated2026/09/01