Unscored severity · published May 16, 2014
CVE-2014-0782
Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00…
–
CVSS
56.7%
EPSS
No
On KEV
Description
Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier allows remote attackers to execute arbitrary code via a crafted packet.
Exploitation
Is it being used?
Exploit prediction (EPSS)56.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BV
B/m9000 VP · Yokogawa
All versions, or not specified · source: NVD
BV
B/m9000 VP Software · Yokogawa
through 7.03.01 · source: NVD
BM
B/m9000cs · Yokogawa
All versions, or not specified · source: NVD
BS
B/m9000cs Software · Yokogawa
through 5.05.01 · source: NVD
CC
Centum CS 1000 · Yokogawa
All versions, or not specified · source: NVD
CC
Centum CS 1000 Software · Yokogawa
All versions, or not specified · source: NVD
CC
Centum CS 3000 · Yokogawa
All versions, or not specified · source: NVD
CC
Centum CS 3000 Entry Class · Yokogawa
All versions, or not specified · source: NVD
CC
Centum CS 3000 Entry Class Software · Yokogawa
through 3.09.50 · source: NVD
CC
Centum CS 3000 Software · Yokogawa
through 2.23.00 · source: NVD
CV
Centum VP · Yokogawa
All versions, or not specified · source: NVD
CV
Centum VP Entry Class · Yokogawa
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0782
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0782
www.securityfocus.com
http://www.securityfocus.com/bid/66130
www.yokogawa.com
http://www.yokogawa.com/dcs/security/ysar/dcs-ysar-index-en.htm.
community.rapid7.com
https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-14-070-01a
US Government Resource
http://ics-cert.us-cert.gov/advisories/ICSA-14-133-01
Vendor Advisory
http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf
More from B/m9000 VP
9.1
CVE-2022-26034
Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to…
8.8
CVE-2022-30707
Violation of secure design principles exists in the communication of CAMS for HIS
7.8
CVE-2023-26593
CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information
7.8
CVE-2022-27188
OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to…
7.5
CVE-2018-16196
Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00…