PT-2022-2095 · Yokogawa+1 · Exaopc+3

Published 2022-01-07 · Updated 2022-03-18 · CVE-2022-21194

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CENTUM VP versions R5.01.00 through R5.04.20 CENTUM VP versions R6.01.00 through R6.08.0 Exaopc versions R3.72.00 through R3.79.00

Description The issue is related to the use of hardcoded credentials in the centralized alarm and event management system CAMS for HIS, distributed control systems CENTUM VP and CENTUM VP Entry Class, and the OPC server Exaopc. Exploitation of this issue may allow an attacker to elevate their privileges. The affected products do not change the passwords of the internal Windows accounts from the initial configuration.

Recommendations For CENTUM VP versions R5.01.00 through R5.04.20, update the internal Windows account passwords from the initial configuration. For CENTUM VP versions R6.01.00 through R6.08.0, update the internal Windows account passwords from the initial configuration. For Exaopc versions R3.72.00 through R3.79.00, update the internal Windows account passwords from the initial configuration.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2022-01925

CVE-2022-21194

Affected Products

Cams For His

Centum Vp

Exaopc

Windows

References · 6

• https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21194 · Security Note
• https://bdu.fstec.ru/vul/2022-01925 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21194 · Vendor Advisory
• https://t.me/cvenotify/28092 · Telegram Post
• https://t.me/cibsecurity/38764 · Telegram Post