CVE-2022-26034
Published Apr 15, 2022
Last updated 3 years ago
Overview
- Description
- Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server.
- Source
- vultures@jpcert.or.jp
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 9.1
- Impact score
- 5.2
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity
- CRITICAL
CVSS 2.0
- Type
- Primary
- Base score
- 5.8
- Impact score
- 4.9
- Exploitability score
- 8.6
- Vector string
- AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
- nvd@nist.gov
- CWE-287
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yokogawa:b\\/m9000_vp:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25A4BB1E-5174-4D2F-879D-8D3B89D7075A",
"versionEndIncluding": "r8.03.01",
"versionStartIncluding": "r8.01.01"
},
{
"criteria": "cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E430419-91C5-4991-9676-4C1B43AB8AE1",
"versionEndIncluding": "r6.09.00",
"versionStartIncluding": "r6.01.10"
},
{
"criteria": "cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:basic:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CAC058F-AA7C-417C-9BF5-453DFC5E6FC7",
"versionEndIncluding": "r06.09.00",
"versionStartIncluding": "r6.01.10"
},
{
"criteria": "cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:small:*:*:*",
"vulnerable": true,
"matchCriteriaId": "70EE0952-6D89-48D3-ABCB-07FCF3613420",
"versionEndIncluding": "r6.09.00",
"versionStartIncluding": "r6.01.10"
}
],
"operator": "OR"
}
]
}
]