HIGH🇵🇱 Wersja polska

CVE-2022-22729

CVSS 8.8v3.1pub. 2022-03-11upd. 2024-11-21

CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Yokogawa Centum Cs 3000

    HW
    Yokogawa
    all versions

  • Yokogawa Centum Cs 3000 Entry

    HW
    Yokogawa
    all versions

  • Yokogawa Centum Cs 3000 Entry Firmware

    OS
    Yokogawa
    r3.08.10 – r3.09.00

  • Yokogawa Centum Cs 3000 Firmware

    OS
    Yokogawa
    r3.08.10 – r3.09.00

  • Yokogawa Centum Vp

    HW
    Yokogawa
    all versions

  • Yokogawa Centum Vp Entry

    HW
    Yokogawa
    all versions

  • Yokogawa Centum Vp Entry Firmware

    OS
    Yokogawa
    r4.01.00 – r4.03.00r6.01.00 – r6.09.00 (excl.)r5.01.00 – r5.04.20

  • Yokogawa Centum Vp Firmware

    OS
    Yokogawa
    r6.01.00 – r6.09.00 (excl.)r4.01.00 – r4.03.00r5.01.00 – r5.04.20

  • Yokogawa Exaopc

    APP
    Yokogawa
    r3.72.00 – r3.80.00 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2022-26034CRITICAL9.1PL ✓same product

Obejście uwierzytelnienia w serwerze AD Yokogawa CENTUM VP i B/M9000 VP

CVE-2022-23402CRITICAL9.8PL ✓same product

Yokogawa CENTUM VP — zakodowane na stałe hasło w aplikacjach CAMS

CVE-2022-21194CRITICAL9.8PL ✓same product

Yokogawa CENTUM VP — niezmienione domyślne hasła kont Windows

CVE-2020-5609CRITICAL9.8PL ✓same product

Path traversal w Yokogawa CENTUM CS 3000/VP — zdalne wykonanie kodu

CVE-2020-5608CRITICAL9.8PL ✓same product

Pominięcie uwierzytelnienia w CAMS for HIS systemów Yokogawa CENTUM