CVE-2022-22729

Name of the Vulnerable Software and Affected Versions CENTUM CS 3000 versions from R3.08.10 to R3.09.00 CENTUM VP versions from R4.01.00 to R4.03.00 CENTUM VP versions from R5.01.00 to R5.04.20 CENTUM VP versions from R6.01.00 to R6.08.00 Exaopc versions from R3.72.00 to R3.79.00

Description The CAMS for HIS Server contained in Yokogawa Electric products improperly authenticates receiving packets, allowing the authentication to be bypassed via crafted packets. This issue is related to weaknesses in the authentication procedure, which can be exploited to execute arbitrary commands.

Recommendations For CENTUM CS 3000 versions from R3.08.10 to R3.09.00, update to a version outside of this range to resolve the issue. For CENTUM VP versions from R4.01.00 to R4.03.00, update to a version outside of this range to resolve the issue. For CENTUM VP versions from R5.01.00 to R5.04.20, update to a version outside of this range to resolve the issue. For CENTUM VP versions from R6.01.00 to R6.08.00, update to a version outside of this range to resolve the issue. For Exaopc versions from R3.72.00 to R3.79.00, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the CAMS for HIS Server to minimize the risk of exploitation.