High severity · published Jan 9, 2019
CVE-2018-16196
Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00…
7.5
CVSS
3.3%
EPSS
No
On KEV
Description
Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00 - R6.03.10), CENTUM VP Entry Class(R4.01.00 - R6.03.10), Exaopc(R3.10.00 - R3.75.00), PRM(R2.06.00 - R3.31.00), ProSafe-RS(R1.02.00 - R4.02.00), FAST/TOOLS(R9.02.00 - R10.02.00), B/M9000 VP(R6.03.01 - R8.01.90)) allows remote attackers to cause a denial of service attack that may result in stopping Vnet/IP Open Communication Driver's communication via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BV
B/m9000 VP · Yokogawa
r6.03.01 through r8.01.90 · source: NVD
CC
Centum CS 3000 Entry Class · Yokogawa
r3.05.00 through r3.09.50 · source: NVD
CC
Centum CS 3000 Firmware · Yokogawa
r3.05.00 through r3.09.50 · source: NVD
CV
Centum VP Entry Class · Yokogawa
r4.01.00 through r6.03.10 · source: NVD
CV
Centum VP Firmware · Yokogawa
r4.01.00 through r6.03.10 · source: NVD
EX
Exaopc · Yokogawa
r3.10.00 through r3.75.00 · source: NVD
FA
Fast/tools · Yokogawa
r9.02.00 through r10.02.00 · source: NVD
PR
Plant Resource Manager · Yokogawa
r2.06.00 through r3.31.00 · source: NVD
PR
Prosafe-rs · Yokogawa
r1.02.00 through r4.02.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16196
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16196
Third Party Advisory
http://www.securityfocus.com/bid/106442
Third Party Advisory
https://jvn.jp/vu/JVNVU93652047/index.html
Vendor Advisory
https://web-material3.yokogawa.com/YSAR-18-0008-E.pdf
More from B/m9000 VP
9.1
CVE-2022-26034
Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to…
8.8
CVE-2022-30707
Violation of secure design principles exists in the communication of CAMS for HIS
7.8
CVE-2023-26593
CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information
7.8
CVE-2022-27188
OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to…
6.5
CVE-2018-8838
A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions…