CVE-2022-22148
📋 TL;DR
This vulnerability in Yokogawa's 'Root Service' allows attackers to exploit improperly configured named pipe ACLs, potentially enabling privilege escalation or unauthorized access. It affects CENTUM CS 3000, CENTUM VP, and Exaopc products across multiple versions. Organizations using these industrial control systems are at risk.
💻 Affected Systems
- CENTUM CS 3000
- CENTUM VP
- Exaopc
📦 What is this software?
Exaopc by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary code with SYSTEM/root privileges, potentially disrupting industrial operations or causing physical damage.
Likely Case
Privilege escalation from a lower-privileged user to SYSTEM/root, enabling unauthorized access to sensitive industrial control system functions.
If Mitigated
Limited impact if proper network segmentation and access controls prevent attackers from reaching vulnerable systems.
🎯 Exploit Status
Exploitation requires some level of initial access to the system; the vulnerability is in ACL configuration rather than a complex memory corruption issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply vendor patches: CENTUM CS 3000: R3.09.50 or later; CENTUM VP: R4.03.50, R5.04.50, R6.08.50 or later; Exaopc: R3.80.00 or later
Vendor Advisory: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
Restart Required: Yes
Instructions:
1. Download patches from Yokogawa support portal. 2. Apply patches according to vendor documentation. 3. Restart affected systems. 4. Verify patch installation.
🔧 Temporary Workarounds
Restrict Named Pipe Access
windowsManually configure stricter ACLs on the vulnerable named pipes to limit access to authorized users only.
Use Windows icacls or Set-ACL PowerShell commands to modify pipe permissions
Network Segmentation
allIsolate affected systems in dedicated network segments with strict firewall rules to limit attack surface.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems from untrusted networks
- Apply principle of least privilege to user accounts and monitor for suspicious named pipe access
🔍 How to Verify
Check if Vulnerable:
Check system version against affected ranges and verify if 'Root Service' is running with vulnerable named pipe configurations.Check Version:
Check product documentation for version verification commands specific to each Yokogawa productVerify Fix Applied:
Verify patch version is installed and test named pipe ACLs to ensure proper permissions are set.📡 Detection & Monitoring
Log Indicators:
- Unusual named pipe creation or access attempts in Windows event logs
- Failed privilege escalation attempts
Network Indicators:
- Unexpected connections to industrial control system services
- Anomalous traffic patterns to/from affected systems
SIEM Query:
EventID=4656 OR EventID=4663 with object name containing pipe paths related to Yokogawa services