Critical severity · published Apr 15, 2022
CVE-2022-26034
Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to…
9.1
CVSS
1%
EPSS
No
On KEV
Description
Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BV
B/m9000 VP · Yokogawa
r8.01.01 through r8.03.01 · source: NVD
CV
Centum VP · Yokogawa
r6.01.10 through r6.09.00; r6.01.10 through r06.09.00; r6.01.10 through r6.09.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26034
Third Party Advisory
https://jvn.jp/vu/JVNVU99204686/index.html
Vendor Advisory
https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/
More from B/m9000 VP
8.8
CVE-2022-30707
Violation of secure design principles exists in the communication of CAMS for HIS
7.8
CVE-2023-26593
CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information
7.8
CVE-2022-27188
OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to…
7.5
CVE-2018-16196
Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00…
6.5
CVE-2018-8838
A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions…