Yokogawa CENTUM (Update A)

Risk Summary

Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to send tampered communication packets or create/overwrite any file and run any commands.

CVEs (2)

Remediations

• Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later.
• For CENTUM CS 3000 (including CENTUM CS 3000 Entry Class) R3.08.10 - R3.09.50 and CENTUM VP (including CENTUM VP Entry Class) R4.01.00 - R4.03.00, no patch will be available because these products are already end of support. Yokogawa recommends that affected customers upgrade to the latest revision of CENTUM VP.
• For CENTUM VP (including CENTUM VP Entry Class) R5.01.00 - R5.04.20, apply patch R5.04.D1
• For CENTUM VP (including CENTUM VP Entry Class) R6.01.00 - R6.07.00, apply patch R6.07.11
• For B/M9000CS R5.04.01 - R5.05.01 and B/M9000 VP R6.01.01 - R8.03.01, Yokogawa reports that this product is not affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to B/M90000 VP to suitable revision.
• For questions related to this report, please contact Yokogawa support.
• More details can also be found in Yokogawa's security advisory report number YSAR-20-0001

Affected Vendors

Affected Products (5)

Affected Sectors

Critical Manufacturing, Energy, Food and Agriculture