Improper authentication in Yokogawa Electric Corporation CENTUM CS 3000
Priority MEDIUM 40CWE-302Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.
Why it matters now
EPSS 0.00945 61st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Yokogawa Electric Corporation | CENTUM CS 3000 | versions from R3.08.10 to R3.09.00 | — | No fix listed | CNA |
| Yokogawa Electric Corporation | CENTUM VP | versions from R4.01.00 to R4.03.00; versions from R5.01.00 to R5.04.20; versions from R6.01.00 to R6.08.00 | — | No fix listed | CNA |
| Yokogawa Electric Corporation | Exaopc | versions from R3.72.00 to R3.79.00 | — | No fix listed | CNA |
- CENTUM CS 3000 VendorYokogawa Electric Corporation Affected versions from R3.08.10 to R3.09.00 Fixed in — No fix listed CNA
- CENTUM VP VendorYokogawa Electric Corporation Affected versions from R4.01.00 to R4.03.00; versions from R5.01.00 to R5.04.20; versions from R6.01.00 to R6.08.00 Fixed in — No fix listed CNA
- Exaopc VendorYokogawa Electric Corporation Affected versions from R3.72.00 to R3.79.00 Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:yokogawa:centum_cs_3000_firmware:*:*:*:*:*:*:*:* | r3.08.10 – r3.09.00 | Vulnerable | Yokogawa Electric Corporation |
| cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Yokogawa Electric Corporation |
| cpe:2.3:o:yokogawa:centum_cs_3000_entry_firmware:*:*:*:*:*:*:*:* | r3.08.10 – r3.09.00 | Vulnerable | Yokogawa Electric Corporation |
| cpe:2.3:h:yokogawa:centum_cs_3000_entry:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Yokogawa Electric Corporation |
| cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:* | r4.01.00 – r4.03.00; r5.01.00 – r5.04.20; r6.01.00 to before r6.09.00 | Vulnerable | Yokogawa Electric Corporation |
| cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Yokogawa Electric Corporation |
| cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:* | r4.01.00 – r4.03.00; r5.01.00 – r5.04.20; r6.01.00 to before r6.09.00 | Vulnerable | Yokogawa Electric Corporation |
| cpe:2.3:h:yokogawa:centum_vp_entry:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Yokogawa Electric Corporation |
| cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:* | r3.72.00 to before r3.80.00 | Vulnerable | Yokogawa Electric Corporation |
- cpe:2.3:o:yokogawa:centum_cs_3000_firmware:*:*:*:*:*:*:*:* Versions r3.08.10 – r3.09.00 Vulnerable ·Yokogawa Electric Corporation
- cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yokogawa Electric Corporation
- cpe:2.3:o:yokogawa:centum_cs_3000_entry_firmware:*:*:*:*:*:*:*:* Versions r3.08.10 – r3.09.00 Vulnerable ·Yokogawa Electric Corporation
- cpe:2.3:h:yokogawa:centum_cs_3000_entry:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yokogawa Electric Corporation
- cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:* Versions r4.01.00 – r4.03.00; r5.01.00 – r5.04.20; r6.01.00 to before r6.09.00 Vulnerable ·Yokogawa Electric Corporation
- cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yokogawa Electric Corporation
- cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:* Versions r4.01.00 – r4.03.00; r5.01.00 – r5.04.20; r6.01.00 to before r6.09.00 Vulnerable ·Yokogawa Electric Corporation
- cpe:2.3:h:yokogawa:centum_vp_entry:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Yokogawa Electric Corporation
- cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:* Versions r3.72.00 to before r3.80.00 Vulnerable ·Yokogawa Electric Corporation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-22729
- 2026-10-03 Alias added: GHSA-23p6-m374-wpr8
References
More Yokogawa Electric Corporation Centum Cs 3000 Entry Firmware vulnerabilities
- TI-2015-04742 Out-of-bounds write in Yokogawa Electric Corporation CENTUM CS 1000 CVSS 3.1CRITICAL 9.8
- TI-2015-04741 Out-of-bounds write in Yokogawa Electric Corporation CENTUM CS 1000 CVSS 3.1CRITICAL 9.8
- TI-2015-04740 Out-of-bounds write in Yokogawa Electric Corporation CENTUM CS 1000 CVSS 3.1CRITICAL 9.8
- TI-2022-06180 Path traversal in Yokogawa Electric Corporation CENTUM CS 3000 CVSS 3.1HIGH 8.8
- TI-2022-06486 Improper output encoding in Yokogawa Electric Corporation CENTUM CS 3000 CVSS 3.1HIGH 8.1
- TI-2022-06481 Uncontrolled resource consumption in Yokogawa Electric Corporation CENTUM CS 3000 CVSS 3.1HIGH 8.1
Sources
- CVE-2022-22729 · CVE Program
- CVE-2022-22729 · NVD
- FIRST EPSS
- GHSA-23p6-m374-wpr8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences