CVE-2022-21177

CVE-2022-21177 affects Yokogawa CAMS for HIS Log Server and is a path traversal vulnerability. Affected products/versions include CENTUM CS 3000 (R3.08.10–R3.09.00), CENTUM VP (R4.01.00–R4.03.00, R5.01.00–R5.04.20, R6.01.00–R6.08.00), and Exaopc (R3.72.00–R3.79.00). The issue arises from path tra...

CVE-2022-21177

There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00, Exaopc versions from...

CVE-2022-22145: Uncontrolled Resource Consumption

CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, from R6.01.00 to R6.08.00, Exaopc versions...

CVE-2022-21194: Use of Hard-coded Credentials

The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.0, Exaopc versions from R3.72.00 to R3.79.00...

CVE-2022-23402: Use of Hard-coded Credentials

The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00...

CVE-2022-22151: Improper Output Neutralization for Logs

CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions fr...

CVE-2022-22148: Incorrect Permission Assignment for Critical Resource

'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc...

Yokogawa Electric 信任管理问题漏洞

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, a Japanese company. A security vulnerability exists in Yokogawa Electric. The following products and versions are affected: CENTUM VP versions R5.01.00 through R5.04.20 and R6.01.00 through R6.08.00, Exaopc versions R3.72.00 through...

CVE-2022-21177: Relative Path Traversal

There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00, Exaopc versions from...

CVE-2022-22729: Authentication Bypass by Assumed-Immutable Data

CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to...

Yokogawa Exaopc 资源管理错误漏洞

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, Japan. A security vulnerability exists in CAMS of the HIS Log Server in Yokogawa Electric. The vulnerability stems from uncontrolled consumption of resources by CAMS. The following products and versions are affected: CENTUM CS 3000...

Yokogawa Exaopc 路径遍历漏洞

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, Japan. A security vulnerability exists in CAMS of the HIS Log Server in Yokogawa Electric. The vulnerability stems from a path traversal in CAMS of HIS Log Server. The following products and versions are affected: CENTUM CS 3000 version...

Yokogawa Exaopc 权限许可和访问控制问题漏洞

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, a Japanese company. A security vulnerability exists in Yokogawa Electric. The vulnerability stems from the "Long-term Data Archive Package" service creating named pipes with incorrect ACL configurations. The following products and...

CVE-2022-22141: Incorrect Permission Assignment for Critical Resource

'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 t...

CVE-2022-23401: Uncontrolled Search Path Element

The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00...

Yokogawa Exaopc 安全漏洞

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, Japan. A security vulnerability exists in CAMS for HIS Log Server in Yokogawa Electric. The vulnerability stems from CAMS for HIS Log Server not properly enabling log output. The following products and versions are affected: CENTUM CS...

Yokogawa Exaopc 操作系统命令注入漏洞

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, a Japanese company. A security vulnerability exists in several Yokogawa Electric products that originates from a root service used in the products that uses incorrect ACL configurations to create and name pipes. The following products a...

CVE-2022-21808: Relative Path Traversal

Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.0...

Yokogawa Exaopc 代码问题漏洞

Yokogawa Electric is a server of Yokogawa Electric Yokogawa, a Japanese company. A security vulnerability exists in Yokogawa Electric. The vulnerability stems from an unsafe DLL loading issue. The following products and versions are affected: CENTUM CS 3000 versions R3.08.10 through R3.09.00,...

The vulnerability of the Root Service function in distributed control systems such as CENTUM VP and CENTUM VP Entry Class allows attackers to escalate their privileges.

The vulnerability of the Root Service function in distributed control systems such as CENTUM VP and CENTUM VP Entry Class is related to the failure to take measures to neutralize special elements used in operating system processes. Exploiting this vulnerability can allow attackers to enhance thei...