CVE-2022-27188 Command injection in CENTUM VP series with VP6E5150(Graphic Builder) installed and B/M9000 VP

High 7.8 Published 15 Apr 2022 Updated 3 Aug 2024

An attacker with local access can execute arbitrary OS commands by altering a Graphic Builder file in Yokogawa CENTUM VP systems.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-27188?

CVE-2022-27188 is a high-severity command injection vulnerability in Yokogawa Electric Corporation CENTUM VP series with VP6E5150(Graphic Builder) installed and B/M9000 VP, published on 15 Apr 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00, CENTUM VP Small R4.01.00 to R4.03.00, CENTUM VP Basic R4.01.00 to R4.03.00, and B/M9000 VP R6.01.01 to R6.03.02, which may allow an attacker who can access the computer where the affected product is installed to execute an arbitrary OS command by altering a file generated using Graphic Builder.

Weakness: CWE-78

Which versions are affected by CVE-2022-27188?

It affects 2 products.

Products include Yokogawa B\/M9000 Vp, Yokogawa Centum Vp.

How do I fix CVE-2022-27188?

No fix has been published for CVE-2022-27188 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-27188 being exploited?

There is no known exploitation of CVE-2022-27188 in the wild and no public exploit code.

Sources

Also known as GHSA-qhhf-33w5-r488.