CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
80.5%
CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to bypass authentication and send altered communication packets via unspecified vectors. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.
#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(500470);
script_version("1.9");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/09/04");
script_cve_id("CVE-2020-5608");
script_xref(name:"ICSA", value:"20-224-01");
script_name(english:"Yokogawa CENTUM Improper Authentication (CVE-2020-5608)");
script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
script_set_attribute(attribute:"description", value:
"CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small,
Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote
unauthenticated attacker to bypass authentication and send altered communication packets via unspecified vectors. This
plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
script_set_attribute(attribute:"see_also", value:"https://jvn.jp/vu/JVNVU97997181/index.html");
script_set_attribute(attribute:"see_also", value:"https://web-material3.yokogawa.com/1/29820/files/YSAR-20-0001-E.pdf");
script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-20-224-01");
script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.
Yokogawa recommends the following mitigations:
- Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later.
- For CENTUM CS 3000 (including CENTUM CS 3000 Entry Class) R3.08.10 รขยย R3.09.50 and CENTUM VP (including CENTUM VP Entry
Class) R4.01.00 รขยย R4.03.00, no patch will be available because these products are already end of support. Yokogawa
recommends that affected customers upgrade to the latest revision of CENTUM VP.
- For CENTUM VP (including CENTUM VP Entry Class) R5.01.00 รขยย R5.04.20, apply patch R5.04.D1
- For CENTUM VP (including CENTUM VP Entry Class) R6.01.00 รขยย R6.07.00, apply patch R6.07.11
- For B/M9000CS R5.04.01 รขยย R5.05.01 and B/M9000 VP R6.01.01 รขยย R8.03.01, Yokogawa reports that this product is not
affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM
CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to
B/M90000 VP to suitable revision.
For questions related to this report, please contact Yokogawa support.
More details can also be found in Yokogawaรขยยs security advisory report number YSAR-20-0001");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-5608");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_cwe_id(287);
script_set_attribute(attribute:"vuln_publication_date", value:"2020/08/05");
script_set_attribute(attribute:"patch_publication_date", value:"2020/08/05");
script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/o:yokogawa:centum_cs_3000_firmware");
script_set_attribute(attribute:"cpe", value:"cpe:/o:yokogawa:centum_vp_firmware");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Tenable.ot");
script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("tenable_ot_api_integration.nasl");
script_require_keys("Tenable.ot/Yokogawa");
exit(0);
}
include('tenable_ot_cve_funcs.inc');
get_kb_item_or_exit('Tenable.ot/Yokogawa');
var asset = tenable_ot::assets::get(vendor:'Yokogawa');
var vuln_cpes = {
"cpe:/o:yokogawa:centum_cs_3000_firmware" :
{"versionEndIncluding" : "r3.09.50", "versionStartIncluding" : "r3.08.10", "family" : "CentumVP"},
"cpe:/o:yokogawa:centum_vp_firmware" :
{"versionEndIncluding" : "r6.07.00", "versionStartIncluding" : "r6.01.00", "family" : "CentumVP"}
};
tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
80.5%