CVE-2019-5909
highpriority · track · 41EPSS 0.054 · 93 %ileEURUUSEPSS · scored 2026-10-27
License Manager Service of YOKOGAWA products (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.00), ProSafe-RS (R3.01.00 - R4.04.00), PRM (R4.01.00 - R4.02.00), B/M9000 VP(R7.01.01 - R8.02.03)) allows remote attackers to bypass access restriction to send malicious files to the PC where License Manager Service runs via unspecified vectors.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationB/M9000 VPcisa_csaf_ot
Yokogawa recommends users of affected devices and versions update to the latest available release. Details about the products, affected revisions, and suggested mitigations are available in the Yokogawa Security Advisory Report “YSAR-198-0001: Vulnerability of access control in License Manager Service of Yokogawa products.” This advisory can be found at the following location:https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdfFor questions related to this report and details regarding how to update to the newest revision, please visit the Yokogawa security website (registration required): https://contact.yokogawa.com/cs/gw?c-id=000498
https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdf - MitigationCENTUM VPcisa_csaf_ot
Yokogawa recommends users of affected devices and versions update to the latest available release. Details about the products, affected revisions, and suggested mitigations are available in the Yokogawa Security Advisory Report “YSAR-198-0001: Vulnerability of access control in License Manager Service of Yokogawa products.” This advisory can be found at the following location:https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdfFor questions related to this report and details regarding how to update to the newest revision, please visit the Yokogawa security website (registration required): https://contact.yokogawa.com/cs/gw?c-id=000498
https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdf - MitigationCENTUM VP Entry Classcisa_csaf_ot
Yokogawa recommends users of affected devices and versions update to the latest available release. Details about the products, affected revisions, and suggested mitigations are available in the Yokogawa Security Advisory Report “YSAR-198-0001: Vulnerability of access control in License Manager Service of Yokogawa products.” This advisory can be found at the following location:https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdfFor questions related to this report and details regarding how to update to the newest revision, please visit the Yokogawa security website (registration required): https://contact.yokogawa.com/cs/gw?c-id=000498
https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdf - MitigationPRMcisa_csaf_ot
Yokogawa recommends users of affected devices and versions update to the latest available release. Details about the products, affected revisions, and suggested mitigations are available in the Yokogawa Security Advisory Report “YSAR-198-0001: Vulnerability of access control in License Manager Service of Yokogawa products.” This advisory can be found at the following location:https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdfFor questions related to this report and details regarding how to update to the newest revision, please visit the Yokogawa security website (registration required): https://contact.yokogawa.com/cs/gw?c-id=000498
https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdf - MitigationProSafe-RScisa_csaf_ot
Yokogawa recommends users of affected devices and versions update to the latest available release. Details about the products, affected revisions, and suggested mitigations are available in the Yokogawa Security Advisory Report “YSAR-198-0001: Vulnerability of access control in License Manager Service of Yokogawa products.” This advisory can be found at the following location:https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdfFor questions related to this report and details regarding how to update to the newest revision, please visit the Yokogawa security website (registration required): https://contact.yokogawa.com/cs/gw?c-id=000498
https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdf
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–10
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (23)
Products and version ranges known to be affected.
- Yokogawa Electric Corporation License Manager Service of YOKOGAWA products≤ (CENTUM VP (R5.01.00 - R6.06.00), CENTUM VP Entry Class (R5.01.00 - R6.06.00), ProSafe-RS (R3.01.00 - R4.04.00), PRM (R4.01.00 - R4.02.00), B/M9000 VP(R7.01.01 - R8.02.03))enisa_euvdEU
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-19-029-01Yokogawa License Manager Service2019-01-29icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to remotely upload files, allowing execution of arbitrary code.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- http://jvn.jp/vu/JVNVU99147082/index.htmlcnnvd
- http://www.securityfocus.com/bid/106772cnnvd
- http://www.yokogawa.comPatchcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2019-5909cnnvd
- https://web-material3.yokogawa.com/1/20653/files/YSAR-19-0001-E.pdfcnnvd
- https://www.securityfocus.com/bid/106772cnnvd
- http://jvn.jp/vu/JVNVU99147082/index.htmlenisa_euvd
- http://www.securityfocus.com/bid/106772enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan