CVE-2015-5628

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
YokogawaCENTUM CS 1000R3.08.70 and earlier
YokogawaCENTUM CS 3000R3.09.50 and earlier
YokogawaCENTUM CS 3000 EntryR3.09.50 and earlier
YokogawaCENTUM VPR5.04.20 and earlier
YokogawaCENTUM VP EntryR5.04.20 and earlier
YokogawaProSafe-RSR3.02.10 and earlier
YokogawaExaopcR3.72.00 and earlier
YokogawaExaquantumR2.85.00 and earlier
YokogawaExaquantum/BatchR2.50.30 and earlier
YokogawaExapilotR3.96.10 and earlier
YokogawaExaplogR3.40.00 and earlier
YokogawaExasmocR4.03.20 and earlier
YokogawaExarqeR4.03.20 and earlier
YokogawaField Wireless Device OPC ServerR2.01.02 and earlier
YokogawaPRMR3.12.00 and earlier
YokogawaSTARDOM VDSR7.30.01 and earlier
YokogawaSTARDOM OPC Server for WindowsR3.40 and earlier
YokogawaFAST/TOOLSR10.01 and earlier
YokogawaB/M9000CSR5.05.01 and earlier
YokogawaB/M9000 VPR7.03.04 and earlier
YokogawaFieldMateR1.01; R1.02

References

Timeline

Published
Feb 5, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-56296.8The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows attackeCVE-2015-56304.3Cross-site scripting (XSS) vulnerability in the NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android CVE-2015-56316.8Cross-site request forgery (CSRF) vulnerability in the Remote UI on Canon PIXMA MG7500 printers allows remote attackers to hijack the authenCVE-2015-56326.8The runtime engine in the Newphoria applican framework before 1.12.3 for Android and before 1.12.2 for iOS allows attackers to bypass a whitCVE-2015-56336.8The Newphoria Auction Camera application for iOS and before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism CVE-2015-56346.8The Newphoria MEGAPHONE MUSIC application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protectioCVE-2015-56356.8The Newphoria Koritore application before 1.1 for Android and before 1.1 for iOS allows attackers to bypass a URL whitelist protection mechaCVE-2015-56366.8The Newphoria Reversi application before 1.0.3 for Android and before 1.2 for iOS allows attackers to bypass a URL whitelist protection mechCVE-2015-56376.8The Newphoria Photon application before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API accesCVE-2015-56384.3Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote atCVE-2015-56397.4niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks.CVE-2015-56406.5baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.
CVE-2015-5628: Critical severity, CVSS 9.8 | Vulnix