Skip to content
Fencer Vulns
critical 9.1

CVE-2022-26034 json

Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.0…

published 2022-04-15 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-30603

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

Improper authentication vulnerability in the communication protocol provided by AD (Automation Design) server of CENTUM VP R6.01.10 to R6.09.00, CENTUM VP Small R6.01.10 to R6.09.00, CENTUM VP Basic R6.01.10 to R6.09.00, and B/M9000 VP R8.01.01 to R8.03.01 allows an attacker to use the functions provided by AD server. This may lead to leakage or tampering of data managed by AD server.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-123-01 updated cvss 6.4

Yokogawa CENTUM and ProSafe-RS

  • Yokogawa B/M9000 VP >= R6.01.01, <= R6.03.02, >= R8.01.01, <= R8.03.01 Yokogawa CENTUM VP (Including CENTUM VP Entry Class) >= R6.01.10, <= R6.09.00 - (if VP6E5000 is installed), >= R6.01.10, <= R6.07.10 (if P6E5000 or P6E5100 are installed) Yokogawa Prosafe-RS >= R4.01.00, <= R4.07.00 (if RS4E5000 is installed), >= R4.01.00, <= R4.05.00 (if RS4E5000 or RS4E5100 are installed)
    affected: vendor fix, mitigation “Users of CENTUM Versions R4.01.00 though R4.03.00: No patch software will be available because these products are no longer supported by the vendor.” contact.yokogawa.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

  • Yokogawa Electric Corporation CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.