CVE-2022-21177

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-11 · updated 2026-06-17
Weakness: CWE-23

Description

There is a path traversal vulnerability in CAMS for HIS Log Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, andfrom R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.

Affected products

Yokogawa Centum Cs 3000 Entry Firmware: from r3.08.10 through r3.09.00
Yokogawa Centum Cs 3000 Firmware: from r3.08.10 through r3.09.00
Yokogawa Centum Vp Entry Firmware: from r4.01.00 through r4.03.00; from r5.01.00 through r5.04.20; from r6.01.00 before r6.09.00 — fixed in r6.09.00
Yokogawa Centum Vp Firmware: from r4.01.00 through r4.03.00; from r5.01.00 through r5.04.20; from r6.01.00 before r6.09.00 — fixed in r6.09.00
Yokogawa Electric Corporation Exaopc: from r3.72.00 before r3.80.00 — fixed in r3.80.00

How to fix

Upgrade to a fixed version: Yokogawa Centum Vp Entry Firmware r6.09.00; Yokogawa Centum Vp Firmware r6.09.00; Yokogawa Electric Corporation Exaopc r3.80.00. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21177 or the next vulnerability affects your stack