CVE-2014-3888 Memory corruption in n/a

What is CVE-2014-3888?

CVE-2014-3888 is a high-severity memory corruption vulnerability in n/a, published on 10 Jul 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000 R3.09.50 and earlier, CENTUM VP R5.03.20 and earlier, Exaopc R3.72.00 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier, when FCS/Test Function is enabled, allows remote attackers to execute arbitrary code via a crafted packet.

Weakness: CWE-119

Which versions are affected by CVE-2014-3888?

It affects 15 products.

Products include Yokogawa B\/M9000 Vp, Yokogawa B\/M9000 Vp Software, Yokogawa B\/M9000cs, Yokogawa B\/M9000cs Software, Yokogawa Centum Cs 1000, Yokogawa Centum Cs 1000 Software and 9 more.

How do I fix CVE-2014-3888?

No fix has been published for CVE-2014-3888 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2014-3888 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-3888 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2022-26034 Auth bypass in CENTUM VP series with VP6E5000(AD Suite Engineering ServerFunction) installed and B/M9000 VP Critical 9.1
• CVE-2022-30707 Information disclosure in CAMS for HIS High 8.8
• CVE-2014-0782 Yokogawa CENTUM CS 3000 Stack-based Buffer Overflow High 8.3
• CVE-2023-26593 Hardcoded credentials in CENTUM series High 7.8
• CVE-2022-27188 Command injection in CENTUM VP series with VP6E5150(Graphic Builder) installed and B/M9000 VP High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-87c7-rqg4-7x74.