PT-2022-2098 · Yokogawa Electric · Centum Cs 3000+2

Published 2022-01-07 · Updated 2022-03-18 · CVE-2022-22145

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions CENTUM CS 3000 versions from R3.08.10 to R3.09.00 CENTUM VP versions from R4.01.00 to R4.03.00 CENTUM VP versions from R5.01.00 to R5.04.20 CENTUM VP versions from R6.01.00 to R6.08.00 Exaopc versions from R3.72.00 to R3.79.00

Description The CAMS for HIS Log Server contained in certain Yokogawa Electric products is vulnerable to uncontrolled resource consumption. This issue may allow an attacker to cause a denial of service.

Recommendations For CENTUM CS 3000 versions from R3.08.10 to R3.09.00, update to a version outside of this range to resolve the issue. For CENTUM VP versions from R4.01.00 to R4.03.00, update to a version outside of this range to resolve the issue. For CENTUM VP versions from R5.01.00 to R5.04.20, update to a version outside of this range to resolve the issue. For CENTUM VP versions from R6.01.00 to R6.08.00, update to a version outside of this range to resolve the issue. For Exaopc versions from R3.72.00 to R3.79.00, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the CAMS for HIS Log Server to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2022-01928

CVE-2022-22145

Affected Products

Centum Cs 3000

Centum Vp

Exaopc

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-22145 · Security Note
• https://bdu.fstec.ru/vul/2022-01928 · Security Note
• https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22145 · Vendor Advisory
• https://t.me/cibsecurity/38770 · Telegram Post
• https://t.me/cvenotify/28090 · Telegram Post