Vulnerability · Published Apr 15, 2022 · Assigned by jpcert

CVE-2022-27188

High 7.8

In plain English

A high-severity security flaw in CENTUM VP series with VP6E5150(Graphic Builder) installed and B/M9000 VP from Yokogawa Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS NVD)7.8High

Exploit odds (30 days)0.5%top 58.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to R6.03.02, which may allow an attacker who can access the computer where the affected product is installed to execute an arbitrary OS command by altering a file generated using Graphic Builder.

Affected products (as reported)

Vendor	Product	Versions
Yokogawa Electric Corporation	CENTUM VP series with VP6E5150(Graphic Builder) installed and B/M9000 VP	CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to R6.03.02

References

https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/ x_refsource_MISC
https://jvn.jp/vu/JVNVU99204686/index.html x_refsource_MISC