← Vulnerability feed

Vulnerability record · CVE-2022-30707 · published 28 June 2022

CVE-2022-30707: Yokogawa centum cs 3000 firmware vulnerability

Yokogawa · Centum Cs 3000 Firmware

Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LHS4800 is installed (CENTUM CS 3000 and CENTUM CS 3000 Small R3.08.10 to R3.09.00), CENTUM series where CAMS function is used (CENTUM VP, CENTUM VP Small, and CENTUM VP Basic R4.01.00 to R4.03.00), CENTUM series regardless of the use of CAMS function (CENTUM VP, CENTUM VP Small, and CENTUM VP Basic R5.01.00 to R5.04.20 and R6.01.00 to R6.09.00), Exaopc R3.72.00 to R3.80.00 (only if NTPF100-S6 'For CENTUM VP Support CAMS for HIS' is installed), B/M9000 CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01). If an adjacent attacker successfully compromises a computer using CAMS for HIS software, they can use credentials from the compromised machine to access data from another machine using CAMS for HIS software. This can lead to a disabling of CAMS for HIS software functions on any affected machines, or information disclosure/alteration.

8.8 CVSS 3.1 High EPSS 0.58% · top 54.5%
8.8CVSS 3.1 base score, v2 5.4
0.58%EPSS exploitation probability, 30 days
NoNot in CISA KEV
7Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LHS4800 is installed (CENTUM CS 3000 and CENTUM CS 3000 Small R3.08.10 to R3.09.00), CENTUM series where CAMS function is used (CENTUM VP, CENTUM VP Small, and CENTUM VP Basic R4.01.00 to R4.03.00), CENTUM series regardless of the use of CAMS function (CENTUM VP, CENTUM VP Small, and CENTUM VP Basic R5.01.00 to R5.04.20 and R6.01.00 to R6.09.00), Exaopc R3.72.00 to R3.80.00 (only if NTPF100-S6 'For CENTUM VP Support CAMS for HIS' is installed), B/M9000 CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01). If an adjacent attacker successfully compromises a computer using CAMS for HIS software, they can use credentials from the compromised machine to access data from another machine using CAMS for HIS software. This can lead to a disabling of CAMS for HIS software functions on any affected machines, or information disclosure/alteration.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

7 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jvn.jp/vu/JVNVU92819891/index.html Third Party AdvisoryVDB Entry
https://web-material3.yokogawa.com/1/32780/files/YSAR-22-0006-E.pdf Vendor Advisory
https://web-material3.yokogawa.com/19/32780/files/YSAR-22-0006-J.pdf Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-02 Third Party AdvisoryUS Government Resource
https://jvn.jp/vu/JVNVU92819891/index.html Third Party AdvisoryVDB Entry
https://web-material3.yokogawa.com/1/32780/files/YSAR-22-0006-E.pdf Vendor Advisory
https://web-material3.yokogawa.com/19/32780/files/YSAR-22-0006-J.pdf Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-02 Third Party AdvisoryUS Government Resource

Track CVE-2022-30707 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-5608Yokogawa centum cs 3000 firmware improper authentication vulnerabilityCAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B…EPSS 1.6%9.8CVE-2020-5609Yokogawa centum cs 3000 firmware path traversal vulnerabilityDirectory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP …EPSS 2.1%9.8CVE-2015-5626Yokogawa centum cs 1000 firmware out-of-bounds write vulnerabilityStack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and e…EPSS 4.2%9.8CVE-2015-5627Yokogawa centum cs 1000 firmware out-of-bounds write vulnerabilityStack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and e…EPSS 4.2%9.8CVE-2015-5628Yokogawa centum cs 1000 firmware out-of-bounds write vulnerabilityStack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and e…EPSS 6.7%9.1CVE-2022-26034Yokogawa b\/m9000 vp improper authentication vulnerabilityImproper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENT…EPSS 0.98%8.8CVE-2022-21808Yokogawa centum cs 3000 firmware relative path traversal vulnerabilityPath traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.…EPSS 1.1%8.8CVE-2022-22729Yokogawa centum cs 3000 firmware improper authentication vulnerabilityCAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be by…EPSS 0.95%

Source: NIST National Vulnerability Database (record CVE-2022-30707), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.