Lucene search

[email protected]CVE-2023-26593

HistoryApr 11, 2023 - 9:15 a.m.

CVE-2023-26593

2023-04-1109:15:08

CWE-312

[email protected]

web.nvd.nist.gov

cve-2023-26593

yokogawa electric corporation

centum series

cleartext storage

privilege escalation

nvd

vulnerability

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or access the computer where the affected product is installed tampers the password file stored in the computer, the user privilege which CENTUM managed may be escalated. As a result, the control system may be operated with the escalated user privilege. To exploit this vulnerability, the following prerequisites must be met: (1)An attacker has obtained user credentials where the affected product is installed, (2)CENTUM Authentication Mode is used for user authentication when CENTUM VP is used. The affected products and versions are as follows: CENTUM CS 1000, CENTUM CS 3000 (Including CENTUM CS 3000 Entry Class) R2.01.00 to R3.09.50, CENTUM VP (Including CENTUM VP Entry Class) R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, and R6.01.00 and later, B/M9000 CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R7.04.51 and R8.01.01 and later

Affected configurations

NVD

Node

yokogawab\/m9000_vpRanger6.01.01–r7.04.51

yokogawab\/m9000_vpRanger8.01.01≥

yokogawab\/m9000csRanger5.04.01–r5.05.01

yokogawacentum_cs_1000Ranger2.01.00–r3.09.50

yokogawacentum_cs_3000Ranger2.01.00–r3.09.50

yokogawacentum_cs_3000_entry_classRanger2.01.00–r3.09.50

yokogawacentum_vpRanger4.01.00–r4.03.00

yokogawacentum_vpRanger5.01.00–r5.04.20

yokogawacentum_vpRanger6.01.00≥

yokogawacentum_vp_entry_classRanger4.01.00–r4.02.00

yokogawacentum_vp_entry_classRanger5.01.00–r5.04.20

yokogawacentum_vp_entry_classRanger6.01.00≥

yokogawaexaopcRanger1.01.00–r1.20.00

yokogawaexaopcRanger2.01.00–r2.10.00

yokogawaexaopcRanger3.01.00≥

CPENameOperatorVersion
yokogawa:b\/m9000_vpyokogawa b/m9000 vpler7.04.51
yokogawa:b\/m9000_vpyokogawa b/m9000 vpeq*
yokogawa:b\/m9000csyokogawa b/m9000csler5.05.01
yokogawa:centum_cs_1000yokogawa centum cs 1000ler3.09.50
yokogawa:centum_cs_3000yokogawa centum cs 3000ler3.09.50
yokogawa:centum_cs_3000_entry_classyokogawa centum cs 3000 entry classler3.09.50
yokogawa:centum_vpyokogawa centum vpler4.03.00
yokogawa:centum_vpyokogawa centum vpler5.04.20
yokogawa:centum_vpyokogawa centum vpeq*
yokogawa:centum_vp_entry_classyokogawa centum vp entry classler4.02.00

CPE	Name	Operator	Version
yokogawa:b\/m9000_vp	yokogawa b/m9000 vp	le	r7.04.51
yokogawa:b\/m9000_vp	yokogawa b/m9000 vp	eq	*
yokogawa:b\/m9000cs	yokogawa b/m9000cs	le	r5.05.01
yokogawa:centum_cs_1000	yokogawa centum cs 1000	le	r3.09.50
yokogawa:centum_cs_3000	yokogawa centum cs 3000	le	r3.09.50
yokogawa:centum_cs_3000_entry_class	yokogawa centum cs 3000 entry class	le	r3.09.50
yokogawa:centum_vp	yokogawa centum vp	le	r4.03.00
yokogawa:centum_vp	yokogawa centum vp	le	r5.04.20
yokogawa:centum_vp	yokogawa centum vp	eq	*
yokogawa:centum_vp_entry_class	yokogawa centum vp entry class	le	r4.02.00

Rows per page:

1-10 of 151

CNA Affected

[
  {
    "vendor": "Yokogawa Electric Corporation",
    "product": "CENTUM series",
    "versions": [
      {
        "version": "CENTUM CS 1000, CENTUM CS 3000 (Including CENTUM CS 3000 Entry Class) R2.01.00 to R3.09.50, CENTUM VP (Including CENTUM VP Entry Class) R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, and R6.01.00 and later, B/M9000 CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R7.04.51 and R8.01.01 and later",
        "status": "affected"
      }
    ]
  }
]

References

jvn.jp/en/vu/JVNVU98775218/

www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for CVE-2023-26593

prion1 cvelist1 nvd1