Yokogawa CENTUM Improper Limitation of a Pathname to a Restricted Directory (CVE-2020-5609)

critical Tenable OT Security Plugin ID 500386

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to create or overwrite arbitrary files and run arbitrary commands via unspecified vectors.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Yokogawa recommends the following mitigations:

- Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later.

- For CENTUM CS 3000 (including CENTUM CS 3000 Entry Class) R3.08.10 – R3.09.50 and CENTUM VP (including CENTUM VP Entry Class) R4.01.00 – R4.03.00, no patch will be available because these products are already end of support. Yokogawa recommends that affected customers upgrade to the latest revision of CENTUM VP.
- For CENTUM VP (including CENTUM VP Entry Class) R5.01.00 – R5.04.20, apply patch R5.04.D1
- For CENTUM VP (including CENTUM VP Entry Class) R6.01.00 – R6.07.00, apply patch R6.07.11
- For B/M9000CS R5.04.01 – R5.05.01 and B/M9000 VP R6.01.01 – R8.03.01, Yokogawa reports that this product is not affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to B/M90000 VP to suitable revision.

For questions related to this report, please contact Yokogawa support.

More details can also be found in Yokogawa’s security advisory report number YSAR-20-0001

Plugin Details

Severity: Critical

ID: 500386

Version: 1.13

Type: remote

Family: Tenable.ot

Published: 2/7/2022

Updated: 11/27/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-5609

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:yokogawa:centum_vp_firmware:r4, cpe:/o:yokogawa:centum_cs_3000_firmware, cpe:/o:yokogawa:centum_vp_firmware:r6, cpe:/o:yokogawa:centum_vp_firmware:r5

Required KB Items: Tenable.ot/Yokogawa

Exploit Ease: No known exploits are available

Patch Publication Date: 8/5/2020

Vulnerability Publication Date: 8/5/2020

Reference Information

CVE: CVE-2020-5609

CWE: 22

ICSA: 20-224-01

Detections

Analytics