CVE-2022-21177
📋 TL;DR
This path traversal vulnerability in Yokogawa's CAMS for HIS Log Server allows attackers to access arbitrary files on affected systems. It affects industrial control systems including CENTUM CS 3000, CENTUM VP, and Exaopc products. Attackers can potentially read sensitive system files through directory traversal techniques.
💻 Affected Systems
- CENTUM CS 3000
- CENTUM VP
- Exaopc
📦 What is this software?
Exaopc by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading of sensitive configuration files, credentials, or system files leading to industrial process disruption or data exfiltration.
Likely Case
Unauthorized access to log files, configuration data, and potentially sensitive operational information from the industrial control system.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external access to vulnerable services.
🎯 Exploit Status
Path traversal vulnerabilities typically have low exploitation complexity. No public exploit code was found at time of analysis, but the vulnerability type is well-understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply patches as specified in Yokogawa security advisory YSAR-22-0001-E
Vendor Advisory: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
Restart Required: Yes
Instructions:
1. Review Yokogawa security advisory YSAR-22-0001-E. 2. Apply vendor-provided patches for your specific product version. 3. Restart affected services/systems. 4. Verify patch application through version checking.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks and implement strict firewall rules
Access Control
allRestrict network access to CAMS for HIS Log Server to only authorized systems and users
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from untrusted networks
- Deploy application firewalls or WAFs with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check product version against affected ranges and verify CAMS for HIS Log Server component is installedCheck Version:
Check through Yokogawa system management tools or product documentation for version informationVerify Fix Applied:
Verify version is outside affected ranges after patch application and test path traversal attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in CAMS logs
- Multiple failed path traversal attempts
- Access to files outside expected directories
Network Indicators:
- HTTP requests with '../' sequences or other path traversal patterns to CAMS service
SIEM Query:
source="cams_logs" AND (uri="*../*" OR uri="*..\\*" OR uri="*%2e%2e%2f*")