7.5

CVE-2014-5208: yokogawa centum_cs_3000_firmware Improper Access Control

CVSS: 7.5v2.0HighModified
Published 22-12-2014Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2014-5208 is a high (CVSS 7.5) Improper Access Control vulnerability in yokogawa centum_cs_3000_firmware. EPSS estimates a 22.54% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
45/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
22.54%
0%100%
High · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference, metasploit

Timeline

  1. 22-12-2014
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

22.54%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 22.54% on 22-09-2026

22-09-202622-10-2026
EPSS score
22.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (community.rapid7.com)

    Maturity: unknown

  • MetasploitMetasploitremoteUnverified

    Yokogawa BKBCopyD.exe Client

    auxiliary/admin/scada/yokogawa_bkbcopyd_client

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Yokogawa3 products

1 vendor · 3 products

References

3 links