CVE-2022-26034 - OpenCVE

Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Yokogawa	B\/m9000 Vp Centum Vp

Configuration 1 [-]

OR	cpe:2.3:a:yokogawa:b\/m9000_vp::::::::
	cpe:2.3:a:yokogawa:centum_vp:::::-:::*
	cpe:2.3:a:yokogawa:centum_vp:::::basic:::*
	cpe:2.3:a:yokogawa:centum_vp:::::small:::*

No data.

References

Link	Providers
https://jvn.jp/vu/JVNVU99204686/index.html
https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/

History

No history.

MITRE

Status: PUBLISHED

Assigner: jpcert

Published: 2022-04-15T01:45:21

Updated: 2024-08-03T04:56:37.370Z

Reserved: 2022-04-01T00:00:00

Link: CVE-2022-26034

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2022-04-15T02:15:08.083

Modified: 2022-04-22T18:45:54.367

Link: CVE-2022-26034

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP", "vendor": "Yokogawa Electric Corporation", "versions": [{"status": "affected", "version": "CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01"}]}], "descriptions": [{"lang": "en", "value": "Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server."}], "problemTypes": [{"descriptions": [{"description": "Improper Authentication", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-04-15T01:45:21", "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/"}, {"tags": ["x_refsource_MISC"], "url": "https://jvn.jp/vu/JVNVU99204686/index.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vultures@jpcert.or.jp", "ID": "CVE-2022-26034", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP", "version": {"version_data": [{"version_value": "CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01"}]}}]}, "vendor_name": "Yokogawa Electric Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Improper Authentication"}]}]}, "references": {"reference_data": [{"name": "https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/", "refsource": "MISC", "url": "https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/"}, {"name": "https://jvn.jp/vu/JVNVU99204686/index.html", "refsource": "MISC", "url": "https://jvn.jp/vu/JVNVU99204686/index.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:56:37.370Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://jvn.jp/vu/JVNVU99204686/index.html"}]}]}, "cveMetadata": {"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "assignerShortName": "jpcert", "cveId": "CVE-2022-26034", "datePublished": "2022-04-15T01:45:21", "dateReserved": "2022-04-01T00:00:00", "dateUpdated": "2024-08-03T04:56:37.370Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:yokogawa:b\\/m9000_vp:*:*:*:*:*:*:*:*", "matchCriteriaId": "25A4BB1E-5174-4D2F-879D-8D3B89D7075A", "versionEndIncluding": "r8.03.01", "versionStartIncluding": "r8.01.01", "vulnerable": true}, {"criteria": "cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:-:*:*:*", "matchCriteriaId": "9E430419-91C5-4991-9676-4C1B43AB8AE1", "versionEndIncluding": "r6.09.00", "versionStartIncluding": "r6.01.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:basic:*:*:*", "matchCriteriaId": "3CAC058F-AA7C-417C-9BF5-453DFC5E6FC7", "versionEndIncluding": "r06.09.00", "versionStartIncluding": "r6.01.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:small:*:*:*", "matchCriteriaId": "70EE0952-6D89-48D3-ABCB-07FCF3613420", "versionEndIncluding": "r6.09.00", "versionStartIncluding": "r6.01.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server."}, {"lang": "es", "value": "Una vulnerabilidad de autenticaci\u00f3n inapropiada en el protocolo de comunicaci\u00f3n proporcionado por el servidor AD (Automation Design) de CENTUM VP versiones R6.01.10 a R6.09.00, CENTUM VP Small versiones R6.01.10 a R6.09.00, CENTUM VP Basic versiones R6.01.10 a R6.09.00, y B/M9000 VP versiones R8.01.01 a R8.03.01 permite a un atacante usar las funciones proporcionadas por el servidor AD. Esto puede conllevar a un filtrado o manipulaci\u00f3n de los datos administrados por el servidor AD"}], "id": "CVE-2022-26034", "lastModified": "2022-04-22T18:45:54.367", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-15T02:15:08.083", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/vu/JVNVU99204686/index.html"}, {"source": "vultures@jpcert.or.jp", "tags": ["Vendor Advisory"], "url": "https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}