SB2020081257 - Multiple vulnerabilities in Yokogawa CENTUM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020081257

SB2020081257 - Multiple vulnerabilities in Yokogawa CENTUM

Published: August 12, 2020

Security Bulletin ID SB2020081257
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Adjecent network
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper Authentication (CVE-ID: CVE-2020-5608)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker on the local network can send tampered communication packets.

This vulnerability affects the following versions of CENTUM: 

  • CENTUM CS 3000 versions R3.08.10 - R3.09.50 (Including CENTUM CS 3000 Entry Class) 
  • CENTUM VP versions R4.01.00 - R6.07.00 (Including CENTUM VP Entry Class) 
  • B/M9000CS versions R5.04.01 - R5.05.01 
  • B/M9000 VP versions R6.01.01 - R8.03.01


2) Path Traversal (CVE-ID: CVE-2020-5609)

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker on the local network can send a specially crafted HTTP request and create or overwrite any file, run any commands

This vulnerability affects the following versions of CENTUM: 

  • CENTUM CS 3000 versions R3.08.10 - R3.09.50 (Including CENTUM CS 3000 Entry Class) 
  • CENTUM VP versions R4.01.00 - R6.07.00 (Including CENTUM VP Entry Class) 
  • B/M9000CS versions R5.04.01 - R5.05.01 
  • B/M9000 VP versions R6.01.01 - R8.03.01


Remediation

Install update from vendor's website.

References