CVE-2022-23402
📋 TL;DR
This vulnerability involves hard-coded credentials in Yokogawa Electric's CENTUM VP and Exaopc products, allowing attackers to gain unauthorized access to CAMS server applications. Affected organizations include industrial control system operators using these specific versions.
💻 Affected Systems
- CENTUM VP
- Exaopc
📦 What is this software?
Exaopc by Yokogawa
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to operational disruption, safety hazards, or data exfiltration
Likely Case
Unauthorized access to control systems allowing configuration changes, data theft, or denial of service
If Mitigated
Limited impact if systems are air-gapped and access controls are properly implemented
🎯 Exploit Status
Exploitation requires knowledge of hard-coded credentials but no authentication; trivial for attackers with network access
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CENTUM VP: R5.04.30 or later, R6.08.10 or later; Exaopc: R3.79.10 or later
Vendor Advisory: https://web-material3.yokogawa.com/1/32094/files/YSAR-22-0001-E.pdf
Restart Required: Yes
Instructions:
1. Download patches from Yokogawa support portal. 2. Apply patches following vendor documentation. 3. Restart affected systems. 4. Change all passwords after patching.
🔧 Temporary Workarounds
Network segmentation
allIsolate affected systems from untrusted networks
Access control lists
allRestrict network access to CAMS servers using firewalls
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to vulnerable systems
- Monitor for unauthorized access attempts and implement multi-factor authentication where possible
🔍 How to Verify
Check if Vulnerable:
Check product version against affected ranges; review system configuration for hard-coded credentialsCheck Version:
Check via product management interface or vendor documentationVerify Fix Applied:
Verify installed version is patched; test authentication with changed credentials📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts, unexpected login events, configuration changes
Network Indicators:
- Unauthorized access to CAMS server ports, unusual traffic patterns
SIEM Query:
source="industrial_control" AND (event_type="authentication" OR event_type="configuration_change")