CVE-2022-33939 Denial of service in CENTUM VP / CS 3000 controller FCS
An attacker can cause a denial of service in Yokogawa CENTUM VP/CS 3000 controllers by sending specially crafted communication packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-33939?
CVE-2022-33939 is a high-severity denial of service vulnerability in Yokogawa Electric Corporation CENTUM VP / CS 3000 controller FCS, published on 16 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CENTUM VP / CS 3000 controller FCS (CP31, CP33, CP345, CP401, and CP451) contains an issue in processing communication packets, which may lead to resource consumption. If this vulnerability is exploited, an attacker may cause a denial of service (DoS) condition in ADL communication by sending a specially crafted packet to the affected product.
Which versions are affected by CVE-2022-33939?
It affects 7 products.
Products include Yokogawa Centum Cs 3000 Cp31 Firmware, Yokogawa Centum Cs 3000 Cp33 Firmware, Yokogawa Centum Cs 3000 Cp345 Firmware, Yokogawa Centum Cs 3000 Cp401 Firmware, Yokogawa Centum Cs 3000 Cp451 Firmware, Yokogawa Centum Vp 3000 Cp401 Firmware and 1 more.
How do I fix CVE-2022-33939?
No fix has been published for CVE-2022-33939 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-33939 being exploited?
There is no known exploitation of CVE-2022-33939 in the wild and no public exploit code.
Sources
Also known as GHSA-hg36-5628-7f89.