Yokogawa Electric vulnerabilities
We track 28 vulnerabilities in Yokogawa Electric products across 20 products. 28 are rated high or critical, and none are known to be exploited. The most recent was published on June 23, 2026.
Latest Yokogawa Electric vulnerabilities
- 8.2 High severity
FAST/TOOLS: Cleartext Transmission of Sensitive Information
Overview: A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server setting information. This information could be exploited by an attacker for other attacks. The affected products and versions ar
- 8.2 High severity
Vnet/IP Interface Package: Integer Underflow (Wrap or Wraparound)
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receive maliciously crafted packets, a DoS attack may cause Vnet/IP communication functions to stop or arbitrary programs to be executed.
- 7.5 High severity
FAST/TOOLS: Use of a Broken or Risky Cryptographic Algorithm
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product supports old SSL/TLS versions, potentially allowing an attacker to decrypt communications with the web server. The affected products and versions are as follow
- 7.5 High severity
FAST/TOOLS: Use of a Broken or Risky Cryptographic Algorithm
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product supports weak cryptographic algorithms, potentially allowing an attacker to decrypt communications with the web server. The affected products and versions are
- 7.5 High severity
FAST/TOOLS: Path Traversal: '..filename'
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are a
- 9.6 Critical severity
FAST/TOOLS: Improper Neutralization of Invalid Characters in Identifiers in Web Pages
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly encode URLs. An attacker could tamper with web pages or execute malicious scripts. The affected products and versions are as follows: FAST/TO
- 9.8 Critical severity
FAST/TOOLS: Improperly Implemented Security Check for Standard
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attacker could potentially use this information to carry out other attacks. The affected products and versions are as follows:
- 9.8 Critical severity
FAST/TOOLS: Reliance on IP Address for Authentication
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts access by IP address. When a worm that randomly searches for IP addresses intrudes into the network, it could potentially be attacked by the worm. Th
- 8.8 High severity
FAST/TOOLS: Improperly Implemented Security Check for Standard
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product lacks HSTS (HTTP Strict Transport Security) configuration. When an attacker performs a Man in the middle (MITM) attack, communications with the web server coul
- 9.8 Critical severity
GX10 / GX20 / GP10 / GP20 Paperless Recorders: Initialization of a Resource with an Insecure Default
Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, any
- 7.5 High severity
Dual-redundant Platform for Computer (PC2CKM): Unchecked Return Value
Denial of Service (DoS) vulnerability has been found in Dual-redundant Platform for Computer. If a computer on which the affected product is installed receives a large number of UDP broadcast packets in a short period, occasionally that computer may restart. I
- 8.5 High severity
CENTUM CS 3000: Improper Access Control
DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into a computer that installed affected product or access to a shared folder, by replacing the DLL file wi
- 7.8 High severity
CENTUM series: Cleartext Storage of Sensitive Information
CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access the computer where the affected product is installed tampers the password file stored in the computer,
- 7.5 High severity
Communication Module for Wide Area…: Use of Insufficiently Random Values
Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (WAC Router) AW810D, which may allow a remote attacker to cause denial-of-service (DoS) condition by sending a specially c
- 7.2 High severity
STARDOM Controller: Use of Hard-coded Credentials
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.
- 7.5 High severity
STARDOM Controller: Cleartext Transmission of Sensitive Information
Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device
- 7.8 High severity
CENTUM VP series with VP6E5150(Graphic…: Improper Neutralization of Special Elements used in an OS Command
OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to R6.03.02, which may allow an attacker who can access the computer where the affe
- 9.1 Critical severity
CENTUM VP series with VP6E5000(AD Suite…: Improper Authentication
Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 all
- 9.8 Critical severity
CENTUM VP: Use of Hard-coded Credentials
The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00
- 7.8 High severity
CENTUM CS 3000: Uncontrolled Search Path Element
The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.
- 8.8 High severity
CENTUM CS 3000: Improper Authentication
CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.
- 8.1 High severity
CENTUM CS 3000: Improper Encoding or Escaping of Output
CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.0
- 7.8 High severity
CENTUM CS 3000: Incorrect Permission Assignment for Critical Resource
'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20,
- 8.1 High severity
CENTUM CS 3000: Uncontrolled Resource Consumption
CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, from R
- 7.8 High severity
CENTUM CS 3000: Improper Privilege Management
'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.0
- 8.8 High severity
CENTUM CS 3000: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R
- 9.8 Critical severity
CENTUM VP: Use of Hard-coded Credentials
The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.0, Exaopc versions from R3.72.00 to R3.79.00.
- 8.1 High severity
CENTUM CS 3000: Improper Limitation of a Pathname to a Restricted Directory
There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.