CVE-2014-0782: Yokogawa CENTUM and related products stack buffer overflow in BKESimmgr.exe

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution in industrial control systems with a high EPSS score and public exploit discussion warrants high priority despite no KEV listing.

What it is

BKESimmgr.exe in the Expanded Test Functions package of multiple Yokogawa DCS products contains a stack-based buffer overflow (CWE-121) reachable via a crafted packet. Successful exploitation allows remote code execution on control-system hosts, which matters because these are industrial control systems where a compromise can affect process availability and integrity.

Impact

A remote attacker can execute arbitrary code with the privileges of the affected process, potentially taking control of the DCS node. The CVSS 2.0 vector indicates partial confidentiality and integrity impact with complete availability impact.

Attack surface

The flaw is network-reachable (AV:N) and requires no authentication (Au:N), though the CVSS vector notes medium access complexity (AC:M). No user interaction is indicated in the record.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented. EPSS 30-day probability is 0.56839 (99th percentile), indicating high predicted likelihood, and references include a Metasploit community blog post, suggesting public exploit tooling may exist.

What to do

• Apply the vendor fix per Yokogawa advisory YSAR-14-0001E and confirm affected CENTUM, Exaopc and B/M9000 versions are upgraded.
• Isolate DCS and control-network segments from business networks and restrict access to the Expanded Test Functions service.
• Filter or block crafted packets to BKESimmgr.exe using ICS-aware firewalls or network segmentation controls.
• Monitor Yokogawa and CISA ICS advisories for updated guidance and any revised affected-version lists.

Detection

• Monitor for unexpected crashes or restarts of BKESimmgr.exe on CENTUM, Exaopc and B/M9000 hosts.
• Inspect network traffic to the Expanded Test Functions service for malformed or oversized packets.
• Alert on unusual child processes or command execution originating from BKESimmgr.exe.
• Review host logs for anomalous activity on DCS nodes around the time of service restarts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.