CVE-2019-5909 Auth bypass in License Manager Service of YOKOGAWA products
Remote attackers can bypass access restrictions to send malicious files to the License Manager Service in Yokogawa industrial control products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-5909?
CVE-2019-5909 is a critical authentication bypass vulnerability in License Manager Service of YOKOGAWA products, published on 13 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
License Manager Service of YOKOGAWA products (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.00), ProSafe-RS (R3.01.00 - R4.04.00), PRM (R4.01.00 - R4.02.00), B/M9000 VP(R7.01.01 - R8.02.03)) allows remote attackers to bypass access restriction to send malicious files to the PC where License Manager Service runs via unspecified vectors.
Weakness: CWE-287
Which versions are affected by CVE-2019-5909?
It affects 4 products.
Products include Yokogawa B\/M 9000 Vp, Yokogawa Centum Vp, Yokogawa Prm, Yokogawa Prosafe-Rs.
How do I fix CVE-2019-5909?
No fix has been published for CVE-2019-5909 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-5909 being exploited?
There is no known exploitation of CVE-2019-5909 in the wild and no public exploit code.
Sources
Also known as GHSA-2ph5-q865-h92c.