CVE-2025-1863 | THREATINT

Description

Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings. This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.

PUBLISHED Reserved 2025-03-03 | Published 2025-04-18 | Updated 2025-04-18 | Assigner YokogawaGroup

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-1188 Insecure Default Initialization of Resource

Product status

Default status

unknown

R5.04.01 or earlier (custom)

affected

Default status

unknown

R5.05.01 or earlier (custom)

affected

Default status

unknown

R4.21 or earlier (custom)

affected

Default status

unknown

R1.31 or earlier (custom)

affected

Default status

unknown

R1.51 or earlier (custom)

affected

Default status

unknown

All versions (custom)

affected

Default status

unknown

All versions (custom)

affected

Default status

unknown

All versions (custom)

affected

References

web-material3.yokogawa.com/1/36974/files/YSAR-25-0001-E.pdf

cve.org (CVE-2025-1863)

nvd.nist.gov (CVE-2025-1863)

Download JSON