Sign-up

ID

VAR-202204-0835


CVE

CVE-2022-27188


TITLE

of Yokogawa Electric Corporation  b/m9000 vp  and  centum vp  In  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-008387

DESCRIPTION

OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to R6.03.02, which may allow an attacker who can access the computer where the affected product is installed to execute an arbitrary OS command by altering a file generated using Graphic Builder. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2022-27188 // JVNDB: JVNDB-2022-008387 // VULHUB: VHN-419228 // VULMON: CVE-2022-27188

AFFECTED PRODUCTS

vendor:yokogawamodel:b\/m9000 vpscope:gteversion:r6.01.01

Trust: 1.0

vendor:yokogawamodel:centum vpscope:lteversion:r4.03.00

Trust: 1.0

vendor:yokogawamodel:b\/m9000 vpscope:lteversion:r6.03.02

Trust: 1.0

vendor:yokogawamodel:centum vpscope:gteversion:r4.01.00

Trust: 1.0

vendor:横河電機株式会社model:centum vpscope: - version: -

Trust: 0.8

vendor:横河電機株式会社model:b/m9000 vpscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-008387 // NVD: CVE-2022-27188

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-27188
value: HIGH

Trust: 1.0

NVD: CVE-2022-27188
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202204-3444
value: HIGH

Trust: 0.6

VULHUB: VHN-419228
value: MEDIUM

Trust: 0.1

VULMON: CVE-2022-27188
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2022-27188
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-419228
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2022-27188
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2022-27188
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-419228 // VULMON: CVE-2022-27188 // JVNDB: JVNDB-2022-008387 // CNNVD: CNNVD-202204-3444 // NVD: CVE-2022-27188

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:OS Command injection (CWE-78) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-419228 // JVNDB: JVNDB-2022-008387 // NVD: CVE-2022-27188

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202204-3444

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-202204-3444

PATCH

title:Yokogawa Electric and Yokogawa Electric CENTUM VP Repair measures for operating system command injection vulnerability in operating systemurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=190475

Trust: 0.6

sources: CNNVD: CNNVD-202204-3444

EXTERNAL IDS

db:NVDid:CVE-2022-27188

Trust: 3.4

db:JVNid:JVNVU99204686

Trust: 2.6

db:ICS CERTid:ICSA-22-123-01

Trust: 1.4

db:JVNDBid:JVNDB-2022-008387

Trust: 0.8

db:CS-HELPid:SB2022050401

Trust: 0.6

db:CNNVDid:CNNVD-202204-3444

Trust: 0.6

db:VULHUBid:VHN-419228

Trust: 0.1

db:VULMONid:CVE-2022-27188

Trust: 0.1

sources: VULHUB: VHN-419228 // VULMON: CVE-2022-27188 // JVNDB: JVNDB-2022-008387 // CNNVD: CNNVD-202204-3444 // NVD: CVE-2022-27188

REFERENCES

url:https://jvn.jp/vu/jvnvu99204686/index.html

Trust: 2.6

url:https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/

Trust: 2.6

url:https://jvn.jp/vu/jvnvu99204686/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-27188

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-22-123-01

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-27188/

Trust: 0.6

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-123-01

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2022050401

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-419228 // VULMON: CVE-2022-27188 // JVNDB: JVNDB-2022-008387 // CNNVD: CNNVD-202204-3444 // NVD: CVE-2022-27188

CREDITS

JPCERT/CC notified CISA of these vulnerabilities.

Trust: 0.6

sources: CNNVD: CNNVD-202204-3444

SOURCES

db:VULHUBid:VHN-419228
db:VULMONid:CVE-2022-27188
db:JVNDBid:JVNDB-2022-008387
db:CNNVDid:CNNVD-202204-3444
db:NVDid:CVE-2022-27188

LAST UPDATE DATE

2024-11-23T19:33:16.077000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-419228date:2022-04-22T00:00:00
db:VULMONid:CVE-2022-27188date:2022-04-22T00:00:00
db:JVNDBid:JVNDB-2022-008387date:2023-07-26T08:25:00
db:CNNVDid:CNNVD-202204-3444date:2022-05-05T00:00:00
db:NVDid:CVE-2022-27188date:2024-11-21T06:55:22.327

SOURCES RELEASE DATE

db:VULHUBid:VHN-419228date:2022-04-15T00:00:00
db:VULMONid:CVE-2022-27188date:2022-04-15T00:00:00
db:JVNDBid:JVNDB-2022-008387date:2023-07-26T00:00:00
db:CNNVDid:CNNVD-202204-3444date:2022-04-15T00:00:00
db:NVDid:CVE-2022-27188date:2022-04-15T02:15:08.133