Skip to content
Fencer Vulns
medium 6.5

CVE-2018-8838 json

A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R…

published 2018-04-17 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-20446

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

A weakness in access controls in CENTUM CS 1000 all versions, CENTUM CS 3000 versions R3.09.50 and earlier, CENTUM CS 3000 Small versions R3.09.50 and earlier, CENTUM VP versions R6.03.10 and earlier, CENTUM VP Small versions R6.03.10 and earlier, CENTUM VP Basic versions R6.03.10 and earlier, Exaopc versions R3.75.00 and earlier, B/M9000 CS all versions, and B/M9000 VP versions R8.01.01 and earlier may allow a local attacker to exploit the message management function of the system. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-18-102-01 updated cvss 6.5

Yokogawa CENTUM and Exaopc

  • Yokogawa B/M9000 CS Yokogawa B/M9000 VP <= R8.01.01 Yokogawa CENTUM CS 1000 Yokogawa CENTUM CS 3000 <= R3.09.50 Yokogawa CENTUM VP <= R6.03.10 Yokogawa CENTUM VP Basic <= R6.03.10
    +2 more products
    Yokogawa CENTUM VP Small <= R6.03.10 Yokogawa Exaopc <= R3.75.00
    affected: vendor fix, mitigation “CENTUM CS 1000, CENTUM CS 3000, CENTUM CS 3000 Small - No updates will be provided as these products are at end of support. Yokogawa recommends that affected users upgrade to the latest CENTUM VP.” web-material3.yokogawa.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
NVD 2.0 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • ICS-CERT Yokogawa CENTUM and Exaopc

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.