PT-2022-1487 · Yokogawa Electric · Centum Cs 3000+2
Published
2022-01-07
·
Updated
2022-03-18
·
CVE-2022-22141
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
CENTUM CS 3000 versions from R3.08.10 to R3.09.00
CENTUM VP versions from R4.01.00 to R4.03.00
CENTUM VP versions from R5.01.00 to R5.04.20
CENTUM VP versions from R6.01.00 to R6.08.00
Exaopc versions from R3.72.00 to R3.79.00
Description
The 'Long-term Data Archive Package' service in Yokogawa Electric products creates a named pipe with improper ACL configuration, which may allow an attacker to elevate their privileges. This issue is related to insufficient access control in the centralized system for managing emergency messages and events.
Recommendations
For CENTUM CS 3000 versions from R3.08.10 to R3.09.00, update to a version outside of this range to mitigate the risk.
For CENTUM VP versions from R4.01.00 to R4.03.00, update to a version outside of this range to mitigate the risk.
For CENTUM VP versions from R5.01.00 to R5.04.20, update to a version outside of this range to mitigate the risk.
For CENTUM VP versions from R6.01.00 to R6.08.00, update to a version outside of this range to mitigate the risk.
For Exaopc versions from R3.72.00 to R3.79.00, update to a version outside of this range to mitigate the risk.
As a temporary workaround, consider restricting access to the named pipe created by the 'Long-term Data Archive Package' service to minimize the risk of exploitation.
Fix
Improper Privilege Management
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Centum Cs 3000
Centum Vp
Exaopc