What’s Vulnerable › Vulnerabilities

CVE-2014-5208

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 22.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-12-22 · updated 2026-06-17
• Weakness: CWE-284

Description

BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784.

Affected products

• Yokogawa Electric Corporation CENTUM CS 3000: r3.01, r3.02, r3.03, r3.04, r3.05, r3.06 (+6)
• Yokogawa Electric Corporation CENTUM VP: through r4.03.00; r5.01.00, r5.01.20, r5.02.00, r5.03.00
• Yokogawa Electric Corporation Exaopc: through 3.71.10

References

• http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0003E.pdf
• https://community.rapid7.com/community/metasploit/blog/2014/08/09/r7-2014-10-disclosure-yokogawa-centum-cs3000-bkbcopydexe-file-system-access
• https://ics-cert.us-cert.gov/advisories/ICSA-14-260-01A
• http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0003E.pdf
• https://community.rapid7.com/community/metasploit/blog/2014/08/09/r7-2014-10-disclosure-yokogawa-centum-cs3000-bkbcopydexe-file-system-access
• https://ics-cert.us-cert.gov/advisories/ICSA-14-260-01A

Get alerted when CVE-2014-5208 or the next vulnerability affects your stack