Medium severity · published Apr 17, 2018
CVE-2018-8838
A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions…
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions R6.03.10 and earlier, CENTUM VP Small versions R6.03.10 and earlier, CENTUM VP Basic versions R6.03.10 and earlier, Exaopc versions R3.75.00 and earlier, B/M9000 CS all versions, and B/M9000 VP versions R8.01.01 and earlier may allow a local attacker to exploit the message management function of the system. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
B/m9000 CS · Yokogawa
All versions, or not specified · source: NVD
BV
B/m9000 VP · Yokogawa
through r8.01.01 · source: NVD
CC
Centum CS 3000 · Yokogawa
through r3.09.50; through r3.09.50 · source: NVD
CV
Centum VP · Yokogawa
through r6.03.10; through r6.03.10; through r6.03.10 · source: NVD
EX
Exaopc · Yokogawa
through r3.75.00 · source: NVD