Yokogawa Electric Corporation vulnerabilities
53 vulnerabilities
Known vulnerabilities in Yokogawa Electric Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 27 products.
Products
27- Fast/Tools18 vulnerabilities
- Centum VP12 vulnerabilities
- Exaopc10 vulnerabilities
- Centum CS 30009 vulnerabilities
- Vnet/Ip Interface Package6 vulnerabilities
- CAMS For HIS3 vulnerabilities
- CI Server3 vulnerabilities
- Stardom Controller2 vulnerabilities
- Centum Series1 vulnerabilities
- Centum VP / CS 3000 Controller FCS1 vulnerabilities
- Centum VP Series With Vp6E5000(Ad Suite Engineering Serverfunction) Installed And B/M9000 VP1 vulnerabilities
- Centum VP Series With Vp6E5150(Graphic Builder) Installed And B/M9000 VP1 vulnerabilities
- Communication Module For Wide Area Communication Router (For Aw810D) Vi4611 vulnerabilities
- Cx1000 / Cx2000 Paperless Recorders1 vulnerabilities
- Dual Redundant Platform For Computer (Pc2Ckm)1 vulnerabilities
- Dx1000 / Dx2000 / Dx1000N Paperless Recorders1 vulnerabilities
- Dx1000T / Dx2000T Paperless Recorders1 vulnerabilities
- Fx1000 Paperless Recorders1 vulnerabilities
- GM Data Acquisition System1 vulnerabilities
- GX10 / GX20 / GP10 / GP20 Paperless Recorders1 vulnerabilities
- License Manager Service Of Yokogawa Products1 vulnerabilities
- Multiple Yokogawa Products For Windows1 vulnerabilities
- Multiple Yokogawa Products That Contain Vnet/Ip Open Communication Driver1 vulnerabilities
- Mw100 Data Acquisition Units1 vulnerabilities
- Μr10000 / Μr20000 Chart Recorders1 vulnerabilities
- Stardom1 vulnerabilities
- The License Management Function Of Yokogawa Products1 vulnerabilities
CVE-2018-16196yokogawa electric corporationmultiple yokogawa products that contain vnet/ip open communication driver+9
EPSS score3.34%
Multiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 - R3.09.50), CENTUM VP(R4.01.00 - R6.03.10), CENTUM VP Entry Class(R4.01.00 - R6.03.10), Exaopc(R3.10.00 - R3.75.00), PRM(R2.06.00 - R3.31.00), ProSafe-RS(R1.02.00 - R4.02.00), FAST/TOOLS(R9.02.00 - R10.02.00), B/M9000 VP(R6.03.01 - R8.01.90)) allows remote attackers to cause a denial of service attack that may result in stopping Vnet/IP Open Communication Driver's communication via unspecified vectors.CVE-2018-0651yokogawa electric corporationthe license management function of yokogawa products+5EPSS score3.97%
Buffer overflow in the license management function of YOKOGAWA products (iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and earlier, STARDOM FCN/FCJ Simulator R4.20 and earlier, ASTPLANNER R15.01 and earlier, TriFellows V5.04 and earlier) allows remote attackers to stop the license management function or execute an arbitrary program via unspecified vectors.CVE-2025-1924yokogawa electric corporationvnet/ip interface package+1EPSS score0.21%
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receive maliciously crafted packets, a DoS attack may cause Vnet/IP communication functions to stop or arbitrary programs to be executed.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlierCVE-2025-1863yokogawa electric corporationcx1000 / cx2000 paperless recorders+7EPSS score0.75%
Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings.
This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.CVE-2025-48022yokogawa electric corporationvnet/ip interface package+1EPSS score0.19%
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlierCVE-2025-48020yokogawa electric corporationvnet/ip interface package+1EPSS score0.25%
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlierCVE-2025-48019yokogawa electric corporationvnet/ip interface package+1EPSS score0.23%
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlierCVE-2025-48023yokogawa electric corporationvnet/ip interface package+1EPSS score0.19%
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlierCVE-2025-48021yokogawa electric corporationvnet/ip interface package+1EPSS score0.19%
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation.
If affected product receives maliciously crafted packets, Vnet/IP software stack process may be terminated.
The affected products and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlierCVE-2025-7741yokogawa electric corporationcentum vpEPSS score0.17%
Hardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account (PROG) used for CENTUM Authentication Mode within the system. Under the following conditions, there is a risk that an attacker could log in as the PROG user.
The default permission for the PROG users is S1 permission (equivalent to OFFUSER). Therefore, for properly permission-controlled targets of operation and monitoring, even if an attacker user in as the PROG user, the risk of critical operations or configuration changes being performed is considered low. (If the PROG user's permissions have been changed for any reason, there is a risk that operations or configuration changes may be performed under the modified permissions. The CVSS values below are for the default permissions.)
Additionally, exploiting this vulnerability requires an attacker to already have access to the HIS screen controls. Therefore, an attacker can already operate and monitor at that point, regardless of this vulnerability.
The conditions under which this vulnerability is exploited:
If all of the following conditions are met, the affected products are vulnerable to this vulnerability.
-An attacker obtains the hardcoded password using a certain method.
-The HIS with the affected product installed is configured in CTM authentication mode.
-An attacker must have direct access to the aforementioned HIS or be able to break into it remotely using a certain method and perform screen operations.
The affected products and versions are as follows: CENTUM VP R5.01.00 to R5.04.20, R6.01.00 to R6.12.00 and R7.01.00.CVE-2025-66601yokogawa electric corporationfast/tools+1EPSS score0.18%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product does not
specify MIME types. When an attacker performs a content sniffing attack,
malicious scripts could be executed.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66607yokogawa electric corporationfast/tools+1EPSS score0.20%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
The response header
contains an insecure setting. Users could be redirected to malicious sites by
an attacker.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66597yokogawa electric corporationfast/tools+1EPSS score0.19%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product supports
weak cryptographic algorithms, potentially allowing an attacker to decrypt
communications with the web server.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66604yokogawa electric corporationfast/tools+1EPSS score0.14%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
The library version
could be displayed on the web page. This information could be exploited by an
attacker for other attacks.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66602yokogawa electric corporationfast/tools+1EPSS score0.35%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
The web server accepts
access by IP address. When a worm that randomly searches for IP addresses
intrudes into the network, it could potentially be attacked by the worm.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66606yokogawa electric corporationfast/tools+1EPSS score0.26%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product does not
properly encode URLs. An attacker could tamper with web pages or execute
malicious scripts.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66596yokogawa electric corporationfast/tools+1EPSS score0.18%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product does not
properly validate request headers. When an attacker inserts an invalid host
header, users could be redirected to malicious sites.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66608yokogawa electric corporationfast/tools+1EPSS score0.45%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product does not
properly validate URLs. An attacker could send specially crafted requests to
steal files from the web server.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66599yokogawa electric corporationfast/toolsEPSS score0.30%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
Physical paths could
be displayed on web pages. This information could be exploited by an attacker
for other attacks.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04CVE-2025-66600yokogawa electric corporationfast/toolsEPSS score0.36%
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product lacks
HSTS (HTTP Strict Transport Security) configuration. When an attacker performs
a Man in the middle (MITM) attack, communications with the web server could be
sniffed.
The
affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to
R10.04