CVE-2019-5909
📋 TL;DR
This vulnerability allows remote attackers to bypass access restrictions in YOKOGAWA License Manager Service and send malicious files to the host PC. It affects multiple YOKOGAWA industrial control system products including CENTUM VP, ProSafe-RS, PRM, and B/M9000 VP. Attackers can exploit this without authentication to potentially compromise critical industrial systems.
💻 Affected Systems
- CENTUM VP
- CENTUM VP Entry Class
- ProSafe-RS
- PRM
- B/M9000 VP
📦 What is this software?
B\/m 9000 Vp by Yokogawa
Centum Vp by Yokogawa
Centum Vp by Yokogawa
Centum Vp by Yokogawa
Prm by Yokogawa
Prosafe Rs by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to process disruption, safety system manipulation, or industrial espionage through remote code execution on critical infrastructure.
Likely Case
Unauthorized file upload leading to malware deployment, system compromise, or denial of service affecting industrial operations.
If Mitigated
Limited impact if systems are air-gapped, have strict network segmentation, and proper access controls preventing external connections.
🎯 Exploit Status
Vulnerability allows bypassing access restrictions via unspecified vectors; CVSS 9.8 suggests low attack complexity with high impact.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches specified in YOKOGAWA Security Advisory YSAR-19-0001-E
Vendor Advisory: https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdf
Restart Required: Yes
Instructions:
1. Download patches from YOKOGAWA support portal. 2. Apply patches according to YOKOGAWA documentation. 3. Restart affected systems. 4. Verify patch installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks using firewalls and network segmentation.
Service Restriction
windowsRestrict network access to License Manager Service ports using host-based firewalls.
netsh advfirewall firewall add rule name="Block YOKOGAWA License Manager" dir=in action=block protocol=TCP localport=[PORT_NUMBER]
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from untrusted networks
- Deploy host-based firewalls to restrict access to License Manager Service ports
🔍 How to Verify
Check if Vulnerable:
Check product version against affected ranges; verify License Manager Service is running on vulnerable versions.Check Version:
Check through YOKOGAWA CENTUM VP/ProSafe-RS/PRM/B/M9000 VP system information panelsVerify Fix Applied:
Verify patch installation through YOKOGAWA management tools; confirm version is outside affected ranges.📡 Detection & Monitoring
Log Indicators:
- Unauthorized connection attempts to License Manager Service
- Unexpected file uploads to License Manager directories
- Service restart or crash events
Network Indicators:
- Unusual traffic to License Manager Service ports from unauthorized sources
- File transfer patterns to industrial control systems
SIEM Query:
source="yokogawa_logs" AND (event_type="unauthorized_access" OR service="License Manager" AND status="failed")