Centum Vp Firmware vulnerabilities

10 known vulnerabilities in Centum Vp Firmware from Yokogawa. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

10vulnerabilities

2critical

8high

0exploited

8.5average CVSS score

Latest first

9.8 Critical severity
CENTUM VP: Use of Hard-coded Credentials
CVE-2022-23402Mar 11, 2022Yokogawa Electric
The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00
7.8 High severity
CENTUM CS 3000: Uncontrolled Search Path Element
CVE-2022-23401Mar 11, 2022Yokogawa Electric
The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.
8.8 High severity
CENTUM CS 3000: Improper Authentication
CVE-2022-22729Mar 11, 2022Yokogawa Electric
CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.
8.1 High severity
CENTUM CS 3000: Improper Encoding or Escaping of Output
CVE-2022-22151Mar 11, 2022Yokogawa Electric
CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.0
7.8 High severity
CENTUM CS 3000: Incorrect Permission Assignment for Critical Resource
CVE-2022-22148Mar 11, 2022Yokogawa Electric
'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20,
8.1 High severity
CENTUM CS 3000: Uncontrolled Resource Consumption
CVE-2022-22145Mar 11, 2022Yokogawa Electric
CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, from R
7.8 High severity
CENTUM CS 3000: Improper Privilege Management
CVE-2022-22141Mar 11, 2022Yokogawa Electric
'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.0
8.8 High severity
CENTUM CS 3000: Improper Limitation of a Pathname to a Restricted Directory
CVE-2022-21808Mar 11, 2022Yokogawa ElectricEPSS 1.06%
Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R
9.8 Critical severity
CENTUM VP: Use of Hard-coded Credentials
CVE-2022-21194Mar 11, 2022Yokogawa Electric
The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.0, Exaopc versions from R3.72.00 to R3.79.00.
8.1 High severity
CENTUM CS 3000: Improper Limitation of a Pathname to a Restricted Directory
CVE-2022-21177Mar 11, 2022Yokogawa Electric
There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.