CVE-2022-21177
High
Description
There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
SeverityHigh
CVSS8.1
Exploit probability—
ProductYokogawa Centum Cs 3000 Firmware
PublishedMar 11, 2022
First seenMar 11, 2022
Weakness typeCWE-23CWE-23
How to fix
Update
- yokogawa centum_vp_firmwarer6.09.00 or later
- yokogawa centum_vp_entry_firmwarer6.09.00 or later
- yokogawa exaopcr3.80.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yokogawa centum_cs_3000_firmware | r3.08.10 ≤ v ≤ r3.09.00 | — |
| yokogawa centum_cs_3000_entry_firmware | r3.08.10 ≤ v ≤ r3.09.00 | — |
| yokogawa centum_vp_firmware | r4.01.00 ≤ v ≤ r4.03.00, r5.01.00 ≤ v ≤ r5.04.20, r6.01.00 ≤ v < r6.09.00 | r6.09.00 |
| yokogawa centum_vp_entry_firmware | r4.01.00 ≤ v ≤ r4.03.00, r5.01.00 ≤ v ≤ r5.04.20, r6.01.00 ≤ v < r6.09.00 | r6.09.00 |
| yokogawa exaopc | r3.72.00 ≤ v < r3.80.00 | r3.80.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.