Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Yokogawa CENTUM and Exaopc allow unauthenticated file access

CVE-2014-5208 · published 11 years ago
Summary

The batch management component in Yokogawa CENTUM CS 3000, CENTUM VP, and Exaopc does not require a login, so a remote user could read or write any file and view database location details. This could let an attacker modify data or steal information. Apply the vendor’s security update and limit network access to these services.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
yokogawa exaopc <= 3.71.10
cpe:2.3:a:yokogawa:exaopc:*:*:*:*:*:*:*:*
yokogawa centum_cs_3000 r3.01
r3.02
r3.03
r3.04
r3.05
r3.06
r3.07
r3.08
r3.08.50
r3.08.70
r3.09
r3.09.50
cpe:2.3:a:yokogawa:centum_cs_3000:r3.01:*:*:*:*:*:*:*
yokogawa centum_vp <= r4.03.00
r5.01.00
r5.01.20
r5.02.00
r5.03.00
cpe:2.3:a:yokogawa:centum_vp:*:*:*:*:*:*:*:*
Original advisory text
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require aut...
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
23% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published22 Dec 2014
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2014-5208 · NVD
Track software like this
Free during beta