← Vulnerability feed

Vulnerability record · CVE-2022-27188 · published 15 April 2022

CVE-2022-27188: Yokogawa b\/m9000 vp os command injection vulnerability

Yokogawa · B\/M9000 Vp

OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to R6.03.02, which may allow an attacker who can access the computer where the affected product is installed to execute an arbitrary OS command by altering a file generated using Graphic Builder.

7.8 CVSS 3.1 High EPSS 0.48% · top 61.1% CWE-78 · OS command injection
7.8CVSS 3.1 base score, v2 4.4
0.48%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to R6.03.02, which may allow an attacker who can access the computer where the affected product is installed to execute an arbitrary OS command by altering a file generated using Graphic Builder.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/vu/JVNVU99204686/index.html Third Party Advisory
https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/ Vendor Advisory
https://jvn.jp/vu/JVNVU99204686/index.html Third Party Advisory
https://www.yokogawa.com/library/resources/white-papers/yokogawa-security-advisory-report-list/ Vendor Advisory

Track CVE-2022-27188 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-5909Yokogawa b\/m 9000 vp improper authentication vulnerabilityLicense Manager Service of YOKOGAWA products (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.00), ProSafe-RS (R3.01.00 - R4…EPSS 5.4%9.1CVE-2022-26034Yokogawa b\/m9000 vp improper authentication vulnerabilityImproper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENT…EPSS 0.98%8.8CVE-2022-30707Yokogawa centum cs 3000 firmware vulnerabilityViolation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LHS4800 is …EPSS 0.58%8.3CVE-2014-3888Yokogawa CENTUM BKFSim_vhfd.exe stack buffer overflowBKFSim_vhfd.exe, a component of Yokogawa CENTUM CS 1000/CS 3000, CENTUM VP, Exaopc and B/M9000 products, contains a stack-based buffer overflow that …EPSS 62%analysed8.3CVE-2014-0782Yokogawa CENTUM and related products stack buffer overflow in BKESimmgr.exeBKESimmgr.exe in the Expanded Test Functions package of multiple Yokogawa DCS products contains a stack-based buffer overflow (CWE-121) reachable via…EPSS 57%analysed7.8CVE-2023-26593Yokogawa b\/m9000 vp cleartext storage of sensitive data vulnerabilityCENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information. If an attacker who can login or…EPSS 0.14%7.5CVE-2018-16196Yokogawa centum cs 3000 firmware improper input validation vulnerabilityMultiple Yokogawa products that contain Vnet/IP Open Communication Driver (CENTUM CS 3000(R3.05.00 - R3.09.50), CENTUM CS 3000 Entry Class(R3.05.00 -…EPSS 3.3%7.5CVE-2014-5208Yokogawa exaopc improper access control vulnerabilityBKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, a…EPSS 23%

Source: NIST National Vulnerability Database (record CVE-2022-27188), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.