{"schemaVersion":3,"id":"CVE-2022-22151","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.","dates":{"published":"2022-03-11T09:10:48.000Z","modified":"2024-08-03T03:07:48.306Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.1,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.9,"severity":"medium","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00804,"percentile":0.56236,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00804},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00804,"percentile":0.56236}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00804,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00804,"percentile":0.56236}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-117","name":"Improper Output Neutralization for Logs","description":"The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/117.html"},{"id":"CWE-116","name":"Improper Encoding or Escaping of Output","description":"The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/116.html"}],"affected":[{"vendor":"yokogawa electric corporation","product":"centum cs 3000","name":"CENTUM CS 3000","label":"centum cs 3000","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"versions from R3.08.10 to R3.09.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"versions from R3.08.10 to R3.09.00","eol":null,"hubHref":"/vendor/yokogawa_electric_corporation/centum_cs_3000"},{"vendor":"yokogawa electric corporation","product":"centum vp","name":"CENTUM VP","label":"centum vp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"versions from R4.01.00 to R4.03.00","noFixRecorded":false,"fixedIn":null},{"text":"versions from R5.01.00 to R5.04.20","noFixRecorded":false,"fixedIn":null},{"text":"versions from R6.01.00 to R6.08.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"versions from R4.01.00 to R4.03.00 | versions from R5.01.00 to R5.04.20 | versions from R6.01.00 to R6.08.00","eol":null,"hubHref":"/vendor/yokogawa_electric_corporation/centum_vp"},{"vendor":"yokogawa electric corporation","product":"exaopc","name":"Exaopc","label":"exaopc","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"versions from R3.72.00 to R3.79.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"versions from R3.72.00 to R3.79.00","eol":null,"hubHref":"/vendor/yokogawa_electric_corporation/exaopc"},{"vendor":"yokogawa","product":"centum_cs_3000_firmware","name":"centum cs 3000 firmware","label":"centum_cs_3000_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ r3.08.10, ≤ r3.09.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ r3.08.10, ≤ r3.09.00","eol":null,"hubHref":"/vendor/yokogawa/centum_cs_3000"},{"vendor":"yokogawa","product":"centum_cs_3000_entry_firmware","name":"centum cs 3000 entry firmware","label":"centum_cs_3000_entry_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ r3.08.10, ≤ r3.09.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ r3.08.10, ≤ r3.09.00","eol":null,"hubHref":"/vendor/yokogawa/centum_cs_3000_entry"},{"vendor":"yokogawa","product":"centum_vp_firmware","name":"centum vp firmware","label":"centum_vp_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ r4.01.00, ≤ r4.03.00","noFixRecorded":false,"fixedIn":null},{"text":"≥ r5.01.00, ≤ r5.04.20","noFixRecorded":false,"fixedIn":null},{"text":"≥ r6.01.00, < r6.09.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ r4.01.00, ≤ r4.03.00 | ≥ r5.01.00, ≤ r5.04.20 | ≥ r6.01.00, < r6.09.00","eol":null,"hubHref":"/vendor/yokogawa/centum_vp"},{"vendor":"yokogawa","product":"centum_vp_entry_firmware","name":"centum vp entry firmware","label":"centum_vp_entry_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ r4.01.00, ≤ r4.03.00","noFixRecorded":false,"fixedIn":null},{"text":"≥ r5.01.00, ≤ r5.04.20","noFixRecorded":false,"fixedIn":null},{"text":"≥ r6.01.00, < r6.09.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ r4.01.00, ≤ r4.03.00 | ≥ r5.01.00, ≤ r5.04.20 | ≥ r6.01.00, < r6.09.00","eol":null,"hubHref":"/vendor/yokogawa/centum_vp_entry"},{"vendor":"yokogawa","product":"exaopc","name":"exaopc","label":"exaopc","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ r3.72.00, < r3.80.00","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ r3.72.00, < r3.80.00","eol":null,"hubHref":"/vendor/yokogawa/exaopc"}],"affectedCount":8,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf","label":"web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf","hostname":"web-material3.yokogawa.com","tags":["X Refsource CONFIRM","Mitigation","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2022-03-11T09:10:48.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-03T03:07:48.306Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T11:52:59.848Z","stale":false,"partial":false}}