Critical severity · published Apr 18, 2025
CVE-2025-1863
Insecure default settings for recorder products
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings.
This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CX1000 / CX2000 Paperless Recorders · Yokogawa Electric Corporation
All versions · source: vendor
DD
DX1000 / DX2000 / DX1000N Paperless Recorders · Yokogawa Electric Corporation
R4.21 or earlier · source: vendor
DD
DX1000T / DX2000T Paperless Recorders · Yokogawa Electric Corporation
All versions · source: vendor
FP
FX1000 Paperless Recorders · Yokogawa Electric Corporation
R1.31 or earlier · source: vendor
GD
GM Data Acquisition System · Yokogawa Electric Corporation
R5.05.01 or earlier · source: vendor
GG
GX10 / GX20 / GP10 / GP20 Paperless Recorders · Yokogawa Electric Corporation
R5.04.01 or earlier · source: vendor
MD
MW100 Data Acquisition Units · Yokogawa Electric Corporation
All versions · source: vendor
ΜΜ
μR10000 / μR20000 Chart Recorders · Yokogawa Electric Corporation
R1.51 or earlier · source: vendor
Affected product
CC
CX1000 / CX2000 Paperless Recorders
Yokogawa Electric Corporation
