Sign-up

ID

VAR-202203-0855


CVE

CVE-2022-22148


TITLE

Yokogawa Exaopc Operating system command injection vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202203-1160

DESCRIPTION

'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00

Trust: 0.99

sources: NVD: CVE-2022-22148 // VULHUB: VHN-414059

AFFECTED PRODUCTS

vendor:yokogawamodel:centum vp entryscope:gteversion:r5.01.00

Trust: 1.0

vendor:yokogawamodel:centum vpscope:gteversion:r4.01.00

Trust: 1.0

vendor:yokogawamodel:centum cs 3000 entryscope:lteversion:r3.09.00

Trust: 1.0

vendor:yokogawamodel:exaopcscope:ltversion:r3.80.00

Trust: 1.0

vendor:yokogawamodel:exaopcscope:gteversion:r3.72.00

Trust: 1.0

vendor:yokogawamodel:centum cs 3000 entryscope:gteversion:r3.08.10

Trust: 1.0

vendor:yokogawamodel:centum vp entryscope:gteversion:r4.01.00

Trust: 1.0

vendor:yokogawamodel:centum vp entryscope:lteversion:r5.04.20

Trust: 1.0

vendor:yokogawamodel:centum vpscope:lteversion:r5.04.20

Trust: 1.0

vendor:yokogawamodel:centum cs 3000scope:lteversion:r3.09.00

Trust: 1.0

vendor:yokogawamodel:centum vpscope:ltversion:r6.09.00

Trust: 1.0

vendor:yokogawamodel:centum vpscope:lteversion:r4.03.00

Trust: 1.0

vendor:yokogawamodel:centum vp entryscope:lteversion:r4.03.00

Trust: 1.0

vendor:yokogawamodel:centum vp entryscope:gteversion:r6.01.00

Trust: 1.0

vendor:yokogawamodel:centum vpscope:gteversion:r6.01.00

Trust: 1.0

vendor:yokogawamodel:centum cs 3000scope:gteversion:r3.08.10

Trust: 1.0

vendor:yokogawamodel:centum vp entryscope:ltversion:r6.09.00

Trust: 1.0

vendor:yokogawamodel:centum vpscope:gteversion:r5.01.00

Trust: 1.0

sources: NVD: CVE-2022-22148

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-22148
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202203-1160
value: HIGH

Trust: 0.6

VULHUB: VHN-414059
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-22148
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

VULHUB: VHN-414059
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-22148
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-414059 // CNNVD: CNNVD-202203-1160 // NVD: CVE-2022-22148

PROBLEMTYPE DATA

problemtype:CWE-732

Trust: 1.1

sources: VULHUB: VHN-414059 // NVD: CVE-2022-22148

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202203-1160

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202203-1160

PATCH

title:Yokogawa Exaopc Fixes for operating system command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=186760

Trust: 0.6

sources: CNNVD: CNNVD-202203-1160

EXTERNAL IDS

db:NVDid:CVE-2022-22148

Trust: 1.7

db:CS-HELPid:SB2022032906

Trust: 0.6

db:AUSCERTid:ESB-2022.1276

Trust: 0.6

db:ICS CERTid:ICSA-22-083-01

Trust: 0.6

db:CNNVDid:CNNVD-202203-1160

Trust: 0.6

db:VULHUBid:VHN-414059

Trust: 0.1

sources: VULHUB: VHN-414059 // CNNVD: CNNVD-202203-1160 // NVD: CVE-2022-22148

REFERENCES

url:https://web-material3.yokogawa.com/1/32094/files/ysar-22-0001-e.pdf

Trust: 1.7

url:https://cxsecurity.com/cveshow/cve-2022-22148/

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022032906

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.1276

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-083-01

Trust: 0.6

sources: VULHUB: VHN-414059 // CNNVD: CNNVD-202203-1160 // NVD: CVE-2022-22148

CREDITS

Jacob Baines from Dragos reported these vulnerabilities to Yokogawa.

Trust: 0.6

sources: CNNVD: CNNVD-202203-1160

SOURCES

db:VULHUBid:VHN-414059
db:CNNVDid:CNNVD-202203-1160
db:NVDid:CVE-2022-22148

LAST UPDATE DATE

2024-11-23T21:32:45.648000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-414059date:2022-03-18T00:00:00
db:CNNVDid:CNNVD-202203-1160date:2022-03-30T00:00:00
db:NVDid:CVE-2022-22148date:2024-11-21T06:46:15.337

SOURCES RELEASE DATE

db:VULHUBid:VHN-414059date:2022-03-11T00:00:00
db:CNNVDid:CNNVD-202203-1160date:2022-03-11T00:00:00
db:NVDid:CVE-2022-22148date:2022-03-11T09:15:11.573