CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.
References
| Link | Resource |
|---|---|
| https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf | Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
|
History
18 Mar 2022, 14:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf - Mitigation, Vendor Advisory | |
| CPE | cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:* cpe:2.3:h:yokogawa:centum_cs_3000_entry:-:*:*:*:*:*:*:* cpe:2.3:h:yokogawa:centum_vp_entry:-:*:*:*:*:*:*:* cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:* cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:yokogawa:centum_cs_3000_entry_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:* cpe:2.3:o:yokogawa:centum_cs_3000_firmware:*:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : 6.0
v3 : 8.8 |
| CWE | CWE-287 |
11 Mar 2022, 09:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-03-11 09:15
Updated : 2024-02-04 22:29
NVD link : CVE-2022-22729
Mitre link : CVE-2022-22729
CVE.ORG link : CVE-2022-22729
JSON object : View
Products Affected
yokogawa
- centum_cs_3000_entry_firmware
- centum_vp_firmware
- exaopc
- centum_vp_entry_firmware
- centum_cs_3000
- centum_vp
- centum_cs_3000_entry
- centum_vp_entry
- centum_cs_3000_firmware