Improper authentication in Yokogawa Electric Corporation CENTUM VP series with VP6E5000…
Priority MEDIUM 41CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server.
Why it matters now
EPSS 0.00981 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Yokogawa Electric Corporation | CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP | CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 | — | No fix listed | CNA |
- CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP VendorYokogawa Electric Corporation Affected CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yokogawa:b\/m9000_vp:*:*:*:*:*:*:*:* | r8.01.01 – r8.03.01 | Vulnerable | Yokogawa Electric Corporation |
| cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:-:*:*:* | r6.01.10 – r6.09.00 | Vulnerable | Yokogawa Electric Corporation |
| cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:basic:*:*:* | r6.01.10 – r06.09.00 | Vulnerable | Yokogawa Electric Corporation |
| cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:small:*:*:* | r6.01.10 – r6.09.00 | Vulnerable | Yokogawa Electric Corporation |
- cpe:2.3:a:yokogawa:b\/m9000_vp:*:*:*:*:*:*:*:* Versions r8.01.01 – r8.03.01 Vulnerable ·Yokogawa Electric Corporation
- cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:-:*:*:* Versions r6.01.10 – r6.09.00 Vulnerable ·Yokogawa Electric Corporation
- cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:basic:*:*:* Versions r6.01.10 – r06.09.00 Vulnerable ·Yokogawa Electric Corporation
- cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:small:*:*:* Versions r6.01.10 – r6.09.00 Vulnerable ·Yokogawa Electric Corporation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-26034
- 2026-10-03 Alias added: GHSA-6r8v-ww3c-grvh
References
More Yokogawa Electric Corporation B/m9000 Vp vulnerabilities
- TI-2014-03162 Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000… CVSS 2.0HIGH 8.3
- TI-2014-00728 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow CVSS 2.0HIGH 8.3
- TI-2022-12843 Violation of secure design principles exists in the communication of CAMS for HIS. CVSS 3.1HIGH 8.8
- TI-2018-11593 Improper input validation in Yokogawa Electric Corporation Multiple Yokogawa products… CVSS 3.0HIGH 7.5
- TI-2023-11727 Cleartext storage of sensitive information in Yokogawa Electric Corporation CENTUM series CVSS 3.1HIGH 7.8
- TI-2022-10311 OS command injection in Yokogawa Electric Corporation CENTUM VP series with VP6E5150… CVSS 3.1HIGH 7.8
Sources
- CVE-2022-26034 · CVE Program
- CVE-2022-26034 · NVD
- FIRST EPSS
- GHSA-6r8v-ww3c-grvh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences