Main Vulnerability Database Vulnerabilities #VU62777

OS Command Injection in Yokogawa products - CVE-2022-27188

Published: May 4, 2022

Vulnerability identifier: #VU62777

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27188

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation. A local user can tamper with files generated by the graphic builder and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

CENTUM VP
B/M9000 VP
CENTUM VP Entry Class

How to mitigate CVE-2022-27188

Install updates from vendor's website.

CENTUM VP - update to R5.01.00
B/M9000 VP - update to R5.01.00
CENTUM VP Entry Class - update to R5.01.00

External References

Related Security Bulletins