Yokogawa CENTUM and ProSafe-RS

1. EXECUTIVE SUMMARY

• CVSS v3 7.5
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Yokogawa
• Equipment: CENTUM and ProSafe-RS
• Vulnerabilities: OS Command Injection, Improper Authentication, NULL Pointer Dereference, Improper Input Validation, Resource Management Errors

2. RISK EVALUATION

Successful exploitation of these vulnerabilities may allow leakage/tampering of data, cause a denial-of-service condition, or allow a local attacker to execute arbitrary programs.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of CENTUM (a Distributed Control System) and ProSafe-RS (Safety Instrumented System), are affected:

CVE-2022-27188: 

• CENTUM VP series: CENTUM VP (Including CENTUM VP Entry Class): R4.01.00 through R4.03.00 (if VP6E5150 is installed)
• B/M9000 VP: R6.01.01 through R6.03.02

CVE-2022-26034:

• CENTUM VP (Including CENTUM VP Entry Class): R6.01.10 through R6.09.00 (if VP6E5000 is installed)
• B/M9000 VP R8.01.01 through R8.03.01 
• Prosafe-RS: R4.01.00 through R4.07.00 – if RS4E5000 is installed

CVE-2019-0203, CVE-2018-11782, CVE-2015-0248:

• CENTUM VP (Including CENTUM VP Entry Class): R6.01.10 through R6.07.10 if VP6E5000 or VP6E5100 are installed
• B/M9000 VP R8.01.01 through R8.03.01
• Prosafe-RS: R4.01.00 through R4.05.00 – if RS4E5000 or RS4E5100 are installed

3.2 VULNERABILITY OVERVIEW

3.2.1    IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION') CWE-78

A local attacker could tamper with files generated by the graphic builder, which may allow arbitrary programs to be executed on a computer that has installed standard operation and monitoring function (HIS).

CVE-2022-27188 has been assigned to this vulnerability. A CVSS v3 base score of 6.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H).

3.2.2    IMPROPER AUTHENTICATION CWE-287

Improper authentication of the communication protocol provided by the Automation Design (AD) server allows an attacker to use the functions provided by the AD server. This may lead to leakage or tampering of data managed by the AD server.

CVE-2022-26034 has been assigned to this vulnerability. A CVSS v3 base score of 6.4 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L).

3.2.3    NULL POINTER DEREFERENCE CWE-476

The AD suite version management function is subjected to malformed packets, which the functions provided by the AD server may stop.

CVE-2019-0203 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.4    IMPROPER INPUT VALIDATION CWE-20

The AD suite version management function is subjected to malformed packets, which the functions provided by the AD server may stop.

CVE-2018-11782 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

3.2.5    RESOURCE MANAGEMENT ERRORS CWE-399

The AD suite version management function is subjected to malformed packets, which the functions provided by the AD server may stop.

CVE-2015-0248 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing, Energy, Food and Agriculture
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

JPCERT/CC notified CISA of these vulnerabilities.

4. MITIGATIONS

Yokogawa recommends the following: 

• Users of CENTUM Versions R6.01.10 through R6.09.00: Update to R6.09.00 and apply patch software (R6.09.04). In an environment where the AD server and Plant Resource Manager (PRM) are linked, there are some precautions to be taken when applying patch software (R6.09.04). Please be sure to check R6.09.04 install manual for details before applying R6.09.04
• Users of CENTUM Versions R4.01.00 though R4.03.00: No patch software will be available because these products are no longer supported by the vendor.
• B/M9000 VP: This product is not affected by these vulnerabilities. However, this product is affected by the existence of CENTUM installed on the same PC. If CENTUM is installed, perform update, and update B/M9000 to suitable revision.
• Users of Prosafe-RS: Update to R4.07.02 or later

Yokogawa also recommends checking the patch software install manual for details before applying patch software as there are some precautions for the following:

• The environment where both CENTUM VP and ProSafe-RS are installed.
• The environment where CENTUM VP’s AD server and PRM are linked.
• The environment where ProSafe-RS’s AD server and PRM are linked.

Contact Yokogawa support for more mitigation information.

For more information see Yokogawa security advisory report: YSAR-22-0004

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:

• Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolate them from the business network.
• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.



CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.



Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target these vulnerabilities. 

• Yokogawa