Read the docs
TI-2025-01608 Aliases CVE-2025-1863GHSA-5rj6-rcrv-5v5p

Insecure default settings for recorder products

Priority MEDIUM 50CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings. This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00752 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Yokogawa Electric CorporationGX10 / GX20 / GP10 / GP20 Paperless RecordersR5.04.01 or earlier—No fix listedCNA
Yokogawa Electric CorporationGM Data Acquisition SystemR5.05.01 or earlier—No fix listedCNA
Yokogawa Electric CorporationDX1000 / DX2000 / DX1000N Paperless RecordersR4.21 or earlier—No fix listedCNA
Yokogawa Electric CorporationFX1000 Paperless RecordersR1.31 or earlier—No fix listedCNA
Yokogawa Electric CorporationμR10000 / μR20000 Chart RecordersR1.51 or earlier—No fix listedCNA
Yokogawa Electric CorporationMW100 Data Acquisition UnitsAll versions—No fix listedCNA
Yokogawa Electric CorporationDX1000T / DX2000T Paperless RecordersAll versions—No fix listedCNA
Yokogawa Electric CorporationCX1000 / CX2000 Paperless RecordersAll versions—No fix listedCNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1863
  2. 2026-10-03 Alias added: GHSA-5rj6-rcrv-5v5p

References

Other 1

  • TI-2014-00729 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow CVSS 2.0CRITICAL 9.0
  • TI-2014-03162 Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000… CVSS 2.0HIGH 8.3
  • TI-2014-00728 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow CVSS 2.0HIGH 8.3
  • TI-2014-00730 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow CVSS 2.0HIGH 8.3
  • TI-2014-00727 Yokogawa CENTUM CS 3000 Heap-based Buffer Overflow CVSS 2.0CRITICAL 9.3
  • TI-2014-04257 BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50… CVSS 2.0HIGH 7.5
See all 71 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences