CVE-2014-5208: yokogawa centum_cs_3000_firmware Improper Access Control
Vulnerability summary
CVE-2014-5208 is a high (CVSS 7.5) Improper Access Control vulnerability in yokogawa centum_cs_3000_firmware. EPSS estimates a 22.54% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 22-12-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
22.54%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 22.54% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundExploit Reference (community.rapid7.com)
Maturity: unknown
Yokogawa BKBCopyD.exe Client
auxiliary/admin/scada/yokogawa_bkbcopyd_client
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Yokogawa3 products
- centum_cs_3000_firmwarer3.01 | r3.02 | r3.03 | r3.04 | r3.05 | r3.06 | r3.07 | r3.08 | r3.08.50 | r3.08.70 | r3.09 | r3.09.50
- centum_vp_firmware≤ r4.03.00 | r5.01.00 | r5.01.20 | r5.02.00 | r5.03.00
- exaopc≤ 3.71.10
1 vendor · 3 products
References
3 links- ics-cert.us-cert.gov/advisories/ICSA-14-260-01AX Refsource MISCThird Party AdvisoryUS Government Resource