Vulnerability · Published Apr 15, 2022 · Assigned by jpcert

CVE-2022-26034

Critical 9.1

In plain English

A critical-severity security flaw in CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP from Yokogawa Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS NVD)9.1Critical

Exploit odds (30 days)1.0%top 37.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server.

Affected products (as reported)

Vendor	Product	Versions
Yokogawa Electric Corporation	CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP	CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01

References

https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/ x_refsource_MISC
https://jvn.jp/vu/JVNVU99204686/index.html x_refsource_MISC