CVE-2022-22148

· HIGHModified

← All CVEs

CVSS v3.1

7.8

EPSS

0.22%

Published

Mar 11, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-732CWE-732

Affected Products (13)

yokogawa · centum_cs_3000_firmwarevulnerable

yokogawa · centum_cs_3000

yokogawa · centum_cs_3000_entry_firmwarevulnerable

yokogawa · centum_cs_3000_entry

yokogawa · centum_vp_firmwarevulnerable

yokogawa · centum_vp_firmware (up to r6.09.00)vulnerable

yokogawa · centum_vp

yokogawa · centum_vp_entry_firmwarevulnerable

yokogawa · centum_vp_entry_firmware (up to r6.09.00)vulnerable

yokogawa · centum_vp_entry

yokogawa · exaopc (up to r3.80.00)vulnerable

References (2)

https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf

Vendor Advisory

https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs