CVE-2020-5609

highPriorität · verfolgen · 40EPSS 0.021 · 81. PerzentilEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

2.07% (81st) EPSS

CVSS 7.5 · high

Is it mine?

23 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to create or overwrite arbitrary files and run arbitrary commands via unspecified vectors.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenB/M9000 VPcisa_csaf_ot
For B/M9000CS R5.04.01 - R5.05.01 and B/M9000 VP R6.01.01 - R8.03.01, Yokogawa reports that this product is not affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to B/M90000 VP to suitable revision.
BehobenB/M9000CScisa_csaf_ot
For B/M9000CS R5.04.01 - R5.05.01 and B/M9000 VP R6.01.01 - R8.03.01, Yokogawa reports that this product is not affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to B/M90000 VP to suitable revision.
BehobenCENTUM CS 3000cisa_csaf_ot
For B/M9000CS R5.04.01 - R5.05.01 and B/M9000 VP R6.01.01 - R8.03.01, Yokogawa reports that this product is not affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to B/M90000 VP to suitable revision.
BehobenCENTUM VPcisa_csaf_ot
For B/M9000CS R5.04.01 - R5.05.01 and B/M9000 VP R6.01.01 - R8.03.01, Yokogawa reports that this product is not affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to B/M90000 VP to suitable revision.
BehobenExaopccisa_csaf_ot
For B/M9000CS R5.04.01 - R5.05.01 and B/M9000 VP R6.01.01 - R8.03.01, Yokogawa reports that this product is not affected by the vulnerabilities but is affected by the existence of CENTUM CS 3000 installed on the same PC. If CENTUM CS 3000 is installed, update B/M90000CS to suitable revision. If CENTUM VP is installed on the same PC, update to B/M90000 VP to suitable revision.
MitigationB/M9000 VPcisa_csaf_ot
Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later.
MitigationB/M9000CScisa_csaf_ot
Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later.
MitigationCENTUM CS 3000cisa_csaf_ot
Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later.
MitigationCENTUM VPcisa_csaf_ot
Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later.
MitigationExaopccisa_csaf_ot
Exaopc R3.72.00 - R3.78.00: Update to R3.78.10 or later.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.08.1highCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Hsecondary · CISA US

v3.18.1highAV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-22USprimärCWE-22USCWE-22US

betroffene Produkte (23)

Betroffene Produkte und Versionsbereiche.

B/M9000 VP: versions R6.01.01 - R8.03.01alle Versionencisa_csaf_otUS
B/M9000CS: versions R5.04.01 - R5.05.01alle Versionencisa_csaf_otUS
CENTUM CS 3000: versions R3.08.10 - R3.09.50 (Including CENTUM CS 3000 Entry Class)alle Versionencisa_csaf_otUS
CENTUM VP: versions R4.01.00 - R6.07.00 (Including CENTUM VP Entry Class)alle Versionencisa_csaf_otUS
Exaopc: (R3.72.00 - R3.78.00)alle Versionencisa_csaf_otUS
Yokogawa B/M9000 VPR6.01.01 | → R8.03.01cisa_csaf_otUS
Yokogawa B/M9000CSR5.04.01 | → R5.05.01cisa_csaf_otUS
Yokogawa CENTUM CS 3000R3.08.10 | → R3.09.50 (Including CENTUM CS 3000 Entry Class)cisa_csaf_otUS
Yokogawa CENTUM VPR4.01.00 | → R6.07.00 (Including CENTUM VP Entry Class)cisa_csaf_otUS
Yokogawa ExaopcR3.72.00 | → R3.78.00cisa_csaf_otUS
Yokogawa Electric Corporation CAMS for HIS≤ CENTUM CS 3000 (includes CENTUM CS 3000 Small) R3.08.10 to R3.09.50, CENTUM VP (includes CENTUM VP Small, Basic) R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01enisa_euvdEU
Yokogawa Electric Corporation B/M9000 VPR6.01.01 → R8.03.01fstec_bduRU
Yokogawa Electric Corporation B/M9000CSR5.04.01 → R5.05.01fstec_bduRU
Yokogawa Electric Corporation CENTUM CS 3000R3.08.10 → R3.09.50fstec_bduRU
Yokogawa Electric Corporation CENTUM VPR4.01.00 → R4.03.00fstec_bduRU
Yokogawa Electric Corporation CENTUM VPR5.01.00 → R5.04.20fstec_bduRU
Yokogawa Electric Corporation CENTUM VPR6.01.00 → R6.07.00fstec_bduRU
yokogawa b/m9000cs firmwarer5.04.01 → r5.05.01nvdUScpe:2.3:o:yokogawa:b\/m9000cs_firmware:*:*:*:*:*:*:*:*
yokogawa b/m9000vp firmwarer6.01.01 → r8.03.01nvdUScpe:2.3:o:yokogawa:b\/m9000vp_firmware:*:*:*:*:*:*:*:*
yokogawa centum cs 3000 firmwarer3.08.10 → r3.09.50nvdUScpe:2.3:o:yokogawa:centum_cs_3000_firmware:*:*:*:*:*:*:*:*

20 von 23 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-20-224-01Yokogawa CENTUM (Update A)2020-08-11icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to send tampered communication packets or create/overwrite any file and run any commands.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot nvd NVD CVE.org MITRE

veröffentlicht 2020-08-05geändert 2026-06-17

verwandt (12,528)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-104286US	—OT kritisch	4.57% (92nd)	KEV	2026-10-01
An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail…
CVE-2026-93616US	—OT kritisch	91.6% (100th)	KEV	2026-09-22
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2026-85706US	—OT kritisch	97.4% (100th)	KEV	2026-09-12
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2…
CVE-2026-66384US	—OT kritisch	0.66% (52nd)	KEV	2026-08-12
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
CVE-2026-59310US	—OT kritisch	2.56% (85th)	KEV	2026-07-30
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

+12523 weitere

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan