CVE-2022-23402

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-11 · updated 2026-06-17
Weakness: CWE-798

Description

The following Yokogawa Electric products hard-code the password for CAMS server applications: CENTUM VP versions from R5.01.00 to R5.04.20 and versions from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00

Affected products

Yokogawa Centum Vp Entry Firmware: from r5.01.00 through r5.04.20; from r6.01.00 before r6.09.00 — fixed in r6.09.00
Yokogawa Centum Vp Firmware: from r5.01.00 through r5.04.20; from r6.01.00 before r6.09.00 — fixed in r6.09.00
Yokogawa Electric Corporation Exaopc: from r3.72.00 before r3.80.00 — fixed in r3.80.00

How to fix

Upgrade to a fixed version: Yokogawa Centum Vp Entry Firmware r6.09.00; Yokogawa Centum Vp Firmware r6.09.00; Yokogawa Electric Corporation Exaopc r3.80.00. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-23402 or the next vulnerability affects your stack