جزئیات آسیب‌پذیری

CVE-2025-1863

Yokogawa Electric CX1000 / CX2000 Paperless RecordersYokogawa Electric DX1000 / DX2000 / DX1000N Paperless RecordersYokogawa Electric DX1000T / DX2000T Paperless RecordersYokogawa Electric FX1000 Paperless RecordersYokogawa Electric GM Data Acquisition SystemYokogawa Electric GX10 / GX20 / GP10 / GP20 Paperless Recorders

Insecure default settings for recorder products

CVSS 3.1
9.8بحرانی

شرح رسمی (انگلیسی)

Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings. This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.

امتیازهای CVSS

امتیازنسخهمنبعبردار
9.8بحرانی 3.1 CVEProject cvelistV5 (CNA) (YokogawaGroup) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

محصولات آسیب‌پذیر

فروشندهمحصولنسخه‌هامنبع
Yokogawa Electric Corporation CX1000 / CX2000 Paperless Recorders All versions CVEProject cvelistV5 (CNA)
Yokogawa Electric Corporation DX1000 / DX2000 / DX1000N Paperless Recorders R4.21 or earlier CVEProject cvelistV5 (CNA)
Yokogawa Electric Corporation DX1000T / DX2000T Paperless Recorders All versions CVEProject cvelistV5 (CNA)
Yokogawa Electric Corporation FX1000 Paperless Recorders R1.31 or earlier CVEProject cvelistV5 (CNA)
Yokogawa Electric Corporation GM Data Acquisition System R5.05.01 or earlier CVEProject cvelistV5 (CNA)
Yokogawa Electric Corporation GX10 / GX20 / GP10 / GP20 Paperless Recorders R5.04.01 or earlier CVEProject cvelistV5 (CNA)
Yokogawa Electric Corporation MW100 Data Acquisition Units All versions CVEProject cvelistV5 (CNA)
Yokogawa Electric Corporation μR10000 / μR20000 Chart Recorders R1.51 or earlier CVEProject cvelistV5 (CNA)

منابع و راهنماها

۱
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.

اطلاعات

تاریخ انتشار
۱۴۰۴/۰۱/۲۹
آخرین به‌روزرسانی
۱۴۰۴/۰۱/۲۹
وضعیت
منتشرشده
صادرکننده (CNA)
YokogawaGroup

پیش‌بینی بهره‌برداری (EPSS)

۰٫۷۵٪
احتمال بهره‌برداری در ۳۰ روز
۵۵٫۲٪
صدک (نسبت به همه‌ی CVEها)

ارزیابی SSVC (CISA)

قابل خودکارسازی
بله
وضعیت بهره‌برداری
ندارد
اثر فنی
کامل

ضعف‌ها (CWE)

  • CWE-1188
    Insecure Default Initialization of Resource