CVE-2022-22729

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-302CWE-287

Affected software

VendorProductVersions
Yokogawa Electric CorporationCENTUM CS 3000versions from R3.08.10 to R3.09.00
Yokogawa Electric CorporationCENTUM VPversions from R4.01.00 to R4.03.00; versions from R5.01.00 to R5.04.20; versions from R6.01.00 to R6.08.00
Yokogawa Electric CorporationExaopcversions from R3.72.00 to R3.79.00

References

Timeline

Published
Mar 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-22738.8The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowiCVE-2022-227309.8Improper authentication in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an unauthenticated user to poteCVE-2022-227319.8A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allowCVE-2022-227327.5A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) suppCVE-2022-227336.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has gCVE-2022-227346.1The Simple Quotation WordPress plugin through 1.3.2 does not have CSRF check when creating or editing a quote and does not sanitise and escaCVE-2022-227358.8The Simple Quotation WordPress plugin through 1.3.2 does not have authorisation (and CSRF) checks in various of its AJAX actions and is lackCVE-2022-227367.0If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directoryCVE-2022-227377.5Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-aftCVE-2022-227388.8Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow causing a potentially CVE-2022-227396.5Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This vulnerability affectCVE-2022-22749.8The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This is