CVE-2022-21194
📋 TL;DR
This vulnerability affects Yokogawa Electric industrial control systems where default Windows account passwords remain unchanged from initial configuration. Attackers can gain unauthorized access to critical industrial systems, potentially compromising process control and safety. Affected organizations include industrial facilities using CENTUM VP or Exaopc systems within specified vulnerable versions.
💻 Affected Systems
- CENTUM VP
- Exaopc
📦 What is this software?
Exaopc by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to process disruption, safety system manipulation, production shutdown, or physical damage to equipment and facilities.
Likely Case
Unauthorized access to control systems allowing data theft, configuration changes, or disruption of industrial processes.
If Mitigated
Limited impact with proper network segmentation, strong authentication controls, and monitoring in place.
🎯 Exploit Status
Exploitation requires knowledge of default credentials but is straightforward once obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CENTUM VP: R5.04.30 or later, R6.08.10 or later; Exaopc: R3.79.10 or later
Vendor Advisory: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
Restart Required: Yes
Instructions:
1. Download updated software from Yokogawa support portal. 2. Backup current configuration. 3. Install updated version following vendor documentation. 4. Restart affected systems. 5. Verify installation and functionality.
🔧 Temporary Workarounds
Change Default Windows Account Passwords
windowsManually change passwords for all Windows accounts on affected systems to strong, unique passwords.
net user [username] [newpassword]
Implement Network Segmentation
allIsolate affected systems from general network and internet access using firewalls and VLANs.
🧯 If You Can't Patch
- Immediately change all default Windows account passwords to strong, unique passwords
- Implement strict network segmentation and access controls to limit exposure
🔍 How to Verify
Check if Vulnerable:
Check system version against affected ranges and verify if default Windows account passwords have been changed.Check Version:
Check version in system information or control panel for Windows systemsVerify Fix Applied:
Confirm installation of patched versions and verify Windows account passwords are no longer default values.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts, successful logins from unexpected locations, account lockouts
Network Indicators:
- Unusual network traffic patterns, connections from unauthorized IP addresses
SIEM Query:
source="windows-security" EventCode=4625 OR EventCode=4624 | where AccountName contains default account names