CVE-2014-3888: Yokogawa CENTUM BKFSim_vhfd.exe stack buffer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote unauthenticated code execution in ICS components with public exploit code and very high EPSS, though exploitation depends on the FCS/Test Function being enabled.

What it is

BKFSim_vhfd.exe, a component of Yokogawa CENTUM CS 1000/CS 3000, CENTUM VP, Exaopc and B/M9000 products, contains a stack-based buffer overflow that is reachable when the FCS/Test Function is enabled. A crafted network packet can overwrite stack memory and lead to arbitrary code execution on the affected host. The flaw matters because these are industrial control system components, and the affected function is a test utility that may be left enabled on production systems.

Impact

A remote, unauthenticated attacker can execute arbitrary code with the privileges of the BKFSim_vhfd.exe process, giving full control of the affected node. Because the host is part of a DCS environment, that access can be used to disrupt or manipulate process control operations.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication required (Au:N), but exploitation requires the FCS/Test Function to be enabled and a crafted packet to be delivered to the service. No user interaction is indicated by the vector.

Exploitation

CVE-2014-3888 is not listed in CISA KEV, but public exploit code exists (Packet Storm and Exploit-DB references tagged as exploits) and EPSS is very high at roughly 0.62 (99th percentile), indicating elevated likelihood of exploitation attempts.

What to do

• Apply the vendor fix per Yokogawa security advisory YSAR-14-0002E and upgrade CENTUM CS 1000, CENTUM CS 3000, CENTUM VP, Exaopc and B/M9000 to the corrected releases.
• Disable the FCS/Test Function on systems where it is not operationally required, since the flaw is only reachable when it is enabled.
• Segment and firewall the DCS network so that only trusted engineering and control hosts can reach the BKFSim_vhfd.exe service; block the port from untrusted networks.
• Monitor vendor and ICS-CERT advisories for updated guidance and apply compensating controls if patching cannot be done immediately.

Detection

• Monitor network traffic to the BKFSim_vhfd.exe service for oversized or malformed packets that could trigger the overflow.
• Alert on unexpected process crashes or restarts of BKFSim_vhfd.exe on CENTUM, Exaopc or B/M9000 hosts.
• Watch for anomalous child processes or outbound connections originating from the BKFSim_vhfd.exe process, which would indicate successful code execution.
• Audit hosts to confirm whether the FCS/Test Function is enabled and flag any that are reachable from outside the control network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.