CVE-2022-21194
Critical
Description
The following Yokogawa Electric products do not change the passwords of the internal Windows accounts from the initial configuration: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.0, Exaopc versions from R3.72.00 to R3.79.00.
SeverityCritical
CVSS9.8
Exploit probability—
ProductYokogawa Centum Vp Firmware
PublishedMar 11, 2022
First seenMar 11, 2022
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- yokogawa centum_vp_firmwarer6.09.00 or later
- yokogawa centum_vp_entry_firmwarer6.09.00 or later
- yokogawa exaopcr3.80.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yokogawa centum_vp_firmware | r5.01.00 ≤ v ≤ r5.04.20, r6.01.00 ≤ v < r6.09.00 | r6.09.00 |
| yokogawa centum_vp_entry_firmware | r4.01.00 ≤ v ≤ r4.03.00, r5.01.00 ≤ v ≤ r5.04.20, r6.01.00 ≤ v < r6.09.00 | r6.09.00 |
| yokogawa exaopc | r3.72.00 ≤ v < r3.80.00 | r3.80.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.