CVE-2022-21194

Name of the Vulnerable Software and Affected Versions CENTUM VP versions R5.01.00 through R5.04.20 CENTUM VP versions R6.01.00 through R6.08.0 Exaopc versions R3.72.00 through R3.79.00

Description The issue is related to the use of hardcoded credentials in the centralized alarm and event management system CAMS for HIS, distributed control systems CENTUM VP and CENTUM VP Entry Class, and the OPC server Exaopc. Exploitation of this issue may allow an attacker to elevate their privileges. The affected products do not change the passwords of the internal Windows accounts from the initial configuration.

Recommendations For CENTUM VP versions R5.01.00 through R5.04.20, update the internal Windows account passwords from the initial configuration. For CENTUM VP versions R6.01.00 through R6.08.0, update the internal Windows account passwords from the initial configuration. For Exaopc versions R3.72.00 through R3.79.00, update the internal Windows account passwords from the initial configuration.