cvelistv5 - cve-2022-23401

cve-2022-23401

Vulnerability from cvelistv5

Published

2022-03-11 09:10

Modified

2024-08-03 03:43

Severity ?

Summary

The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.

References

▼	URL	Tags
	vultures@jpcert.or.jp	https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf	Vendor Advisory

Impacted products

▼	Vendor	Product
	Yokogawa Electric Corporation	CENTUM CS 3000
	Yokogawa Electric Corporation	CENTUM VP
	Yokogawa Electric Corporation	Exaopc

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T03:43:45.875Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CENTUM CS 3000",
          "vendor": "Yokogawa Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions from R3.08.10 to R3.09.00"
            }
          ]
        },
        {
          "product": "CENTUM VP",
          "vendor": "Yokogawa Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions from R4.01.00 to R4.03.00"
            },
            {
              "status": "affected",
              "version": "versions from R5.01.00 to R5.04.20"
            },
            {
              "status": "affected",
              "version": "versions from R6.01.00 to R6.08.00"
            }
          ]
        },
        {
          "product": "Exaopc",
          "vendor": "Yokogawa Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "versions from R3.72.00 to R3.79.00"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "CWE-427: Uncontrolled Search Path Element",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-11T09:10:51",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2022-23401",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CENTUM CS 3000",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from R3.08.10 to R3.09.00"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "CENTUM VP",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from R4.01.00 to R4.03.00"
                          },
                          {
                            "version_value": "versions from R5.01.00 to R5.04.20"
                          },
                          {
                            "version_value": "versions from R6.01.00 to R6.08.00"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Exaopc",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions from R3.72.00 to R3.79.00"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Yokogawa Electric Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-427: Uncontrolled Search Path Element"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf",
              "refsource": "CONFIRM",
              "url": "https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-23401",
    "datePublished": "2022-03-11T09:10:51",
    "dateReserved": "2022-02-03T00:00:00",
    "dateUpdated": "2024-08-03T03:43:45.875Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-23401\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2022-03-11T09:15:11.873\",\"lastModified\":\"2022-03-18T14:57:12.080\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.\"},{\"lang\":\"es\",\"value\":\"Los siguientes productos de Yokogawa Electric contienen problemas de carga de DLL no segura. CENTUM CS 3000 versiones desde R3.08.10 a R3.09.00, CENTUM VP versiones desde R4.01.00 a R4.03.00, desde R5.01.00 a R5.04.20, y desde R6.01.00 a R6.08.00, Exaopc versiones desde R3.72.00 a R3.79.00\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:H/Au:N/C:P/I:P/A:P\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"HIGH\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":3.7},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":1.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-427\"}]},{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-427\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_cs_3000_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r3.08.10\",\"versionEndIncluding\":\"r3.09.00\",\"matchCriteriaId\":\"9D7B6EFE-A886-4409-BE19-E67C0057265B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:yokogawa:centum_cs_3000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BAF123F6-D4A3-49B3-B8BC-14AA63E3A46A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_cs_3000_entry_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r3.08.10\",\"versionEndIncluding\":\"r3.09.00\",\"matchCriteriaId\":\"CBD66947-E8ED-45FC-8A71-14D4CB8D7368\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:yokogawa:centum_cs_3000_entry:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"67BFCAD6-7540-4279-92C5-9ADAB35CD4A7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r4.01.00\",\"versionEndIncluding\":\"r4.03.00\",\"matchCriteriaId\":\"D0D63842-D6A8-4FA1-B09C-71E9113FF95A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r5.01.00\",\"versionEndIncluding\":\"r5.04.20\",\"matchCriteriaId\":\"D647BA49-5A43-437B-8C58-0294A452AF8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r6.01.00\",\"versionEndExcluding\":\"r6.09.00\",\"matchCriteriaId\":\"01914A03-6248-4183-94FE-64902B0D1DDF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:yokogawa:centum_vp:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"161A4767-228C-4681-9D20-81D9380CE48A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r4.01.00\",\"versionEndIncluding\":\"r4.03.00\",\"matchCriteriaId\":\"1CDBFA61-421D-484C-B33E-938CD58BDCEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r5.01.00\",\"versionEndIncluding\":\"r5.04.20\",\"matchCriteriaId\":\"B25462B1-4031-4FAB-8C67-CF060BE472B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:yokogawa:centum_vp_entry_firmware:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r6.01.00\",\"versionEndExcluding\":\"r6.09.00\",\"matchCriteriaId\":\"27CBFAD9-1DD0-4B18-B8F6-6EB8F6396556\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:yokogawa:centum_vp_entry:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E37ECBA-48F6-456A-AE49-83347A91208B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"r3.72.00\",\"versionEndExcluding\":\"r3.80.00\",\"matchCriteriaId\":\"4D5233E5-DABF-4CCE-A92F-F437DECFBCB9\"}]}]}],\"references\":[{\"url\":\"https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf\",\"source\":\"vultures@jpcert.or.jp\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2022-23401

Vulnerability from cvelistv5

gsd-2022-23401

Vulnerability from gsd

var-202203-0848

Vulnerability from variot

ghsa-vhjx-fp2h-r69m

Vulnerability from github

Tags

Sightings

Nomenclature