Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-5650

Summary
Assigner-YokogawaGroup
Assigner Org ID-7168b535-132a-4efe-a076-338f829b2eb9
Published At-17 Jun, 2024 | 06:21
Updated At-01 Aug, 2024 | 21:18
Rejected At-
Credits

DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into a computer that installed affected product or access to a shared folder, by replacing the DLL file with a tampered one, it is possible to execute arbitrary programs with the authority of the SYSTEM account. The affected products and versions are as follows: CENTUM CS 3000 R3.08.10 to R3.09.50 CENTUM VP R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, R6.01.00 to R6.11.10.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:YokogawaGroup
Assigner Org ID:7168b535-132a-4efe-a076-338f829b2eb9
Published At:17 Jun, 2024 | 06:21
Updated At:01 Aug, 2024 | 21:18
Rejected At:
▼CVE Numbering Authority (CNA)

DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into a computer that installed affected product or access to a shared folder, by replacing the DLL file with a tampered one, it is possible to execute arbitrary programs with the authority of the SYSTEM account. The affected products and versions are as follows: CENTUM CS 3000 R3.08.10 to R3.09.50 CENTUM VP R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, R6.01.00 to R6.11.10.

Affected Products
Vendor
Yokogawa Electric Corporation
Product
CENTUM CS 3000
Default Status
unknown
Versions
Affected
  • From R3.08.10 through R3.09.50 (custom)
Vendor
Yokogawa Electric Corporation
Product
CENTUM VP
Default Status
unknown
Versions
Affected
  • From R4.01.00 through R4.03.00 (custom)
  • From R5.01.00 through R5.04.20 (custom)
  • From R6.01.00 through R6.11.10 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-284CWE-284
Type: CWE
CWE ID: CWE-284
Description: CWE-284
Metrics
VersionBase scoreBase severityVector
3.18.5HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Version: 3.1
Base score: 8.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf
vendor-advisory
Hyperlink: https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf
Resource:
vendor-advisory
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Vendor
yokogawa
Product
centum_cs_3000
CPEs
  • cpe:2.3:h:yokogawa:centum_cs_3000:r3.08.10:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From r3.08.10 through r3.09.50 (custom)
Vendor
yokogawa
Product
centum_vp
CPEs
  • cpe:2.3:a:yokogawa:centum_vp:r4.01.00:*:*:*:-:*:*:*
Default Status
unknown
Versions
Affected
  • From r4.01.00 through f4.03.00 (custom)
Vendor
yokogawa
Product
centum_vp
CPEs
  • cpe:2.3:a:yokogawa:centum_vp:r6.01.00:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From r5.01.00 through r5.04.20 (custom)
Vendor
yokogawa
Product
centum_vp
CPEs
  • cpe:2.3:a:yokogawa:centum_vp:r6.01.00:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • From r6.01.00 through r6.11.10 (custom)
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf
vendor-advisory
x_transferred
Hyperlink: https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf
Resource:
vendor-advisory
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:7168b535-132a-4efe-a076-338f829b2eb9
Published At:17 Jun, 2024 | 07:15
Updated At:15 Apr, 2026 | 00:35

DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow able to intrude into a computer that installed affected product or access to a shared folder, by replacing the DLL file with a tampered one, it is possible to execute arbitrary programs with the authority of the SYSTEM account. The affected products and versions are as follows: CENTUM CS 3000 R3.08.10 to R3.09.50 CENTUM VP R4.01.00 to R4.03.00, R5.01.00 to R5.04.20, R6.01.00 to R6.11.10.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.5HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-284Secondary7168b535-132a-4efe-a076-338f829b2eb9
CWE ID: CWE-284
Type: Secondary
Source: 7168b535-132a-4efe-a076-338f829b2eb9
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf7168b535-132a-4efe-a076-338f829b2eb9
N/A
https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdfaf854a3a-2127-422b-91ae-364da2661108
N/A
Hyperlink: https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf
Source: 7168b535-132a-4efe-a076-338f829b2eb9
Resource: N/A
Hyperlink: https://web-material3.yokogawa.com/1/36044/files/YSAR-24-0002-E.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

5Records found
CVE-2014-5208
Matching Score-6
Assigner-CERT/CC
ShareView Details
Matching Score-6
Assigner-CERT/CC
CVSS Score-7.5||HIGH
EPSS-23.12% / 97.48%
||
7 Day CHG~0.00%
Published-22 Dec, 2014 | 17:00
Updated-06 May, 2026 | 22:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbitrary files via a STOR operation, or obtain sensitive database-location information via a PMODE operation, a different vulnerability than CVE-2014-0784.

Action-Not Available
Vendor-yokogawan/a
Product-exaopccentum_vpcentum_cs_3000n/a
CWE ID-CWE-284
Improper Access Control
CVE-2024-43479
Matching Score-4
Assigner-Microsoft Corporation
ShareView Details
Matching Score-4
Assigner-Microsoft Corporation
CVSS Score-8.5||HIGH
EPSS-0.88% / 54.69%
||
7 Day CHG~0.00%
Published-10 Sep, 2024 | 16:54
Updated-31 Dec, 2024 | 23:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Microsoft Power Automate Desktop Remote Code Execution Vulnerability

Microsoft Power Automate Desktop Remote Code Execution Vulnerability

Action-Not Available
Vendor-Microsoft Corporation
Product-power_automatePower Automate for Desktop
CWE ID-CWE-284
Improper Access Control
CVE-2026-46870
Matching Score-4
Assigner-Oracle
ShareView Details
Matching Score-4
Assigner-Oracle
CVSS Score-8.5||HIGH
EPSS-0.31% / 22.92%
||
7 Day CHG~0.00%
Published-16 Jun, 2026 | 19:27
Updated-22 Jun, 2026 | 15:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Shell. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

Action-Not Available
Vendor-Oracle Corporation
Product-mysql_shellMySQL Shell
CWE ID-CWE-284
Improper Access Control
CVE-2026-46915
Matching Score-4
Assigner-Oracle
ShareView Details
Matching Score-4
Assigner-Oracle
CVSS Score-8.5||HIGH
EPSS-0.31% / 22.92%
||
7 Day CHG~0.00%
Published-16 Jun, 2026 | 19:27
Updated-18 Jun, 2026 | 20:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Production). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. While the vulnerability is in Oracle Complex Maintenance, Repair and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

Action-Not Available
Vendor-Oracle Corporation
Product-complex_maintenance_repair_and_overhaulOracle Complex Maintenance, Repair and Overhaul
CWE ID-CWE-284
Improper Access Control
CVE-2023-41679
Matching Score-4
Assigner-Fortinet, Inc.
ShareView Details
Matching Score-4
Assigner-Fortinet, Inc.
CVSS Score-7.7||HIGH
EPSS-0.53% / 41.19%
||
7 Day CHG~0.00%
Published-10 Oct, 2023 | 16:51
Updated-16 Dec, 2025 | 18:23
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission on his profile and belonging to a specific ADOM to add and delete CLI script on other ADOMs

Action-Not Available
Vendor-Fortinet, Inc.
Product-fortimanagerFortiManager
CWE ID-CWE-284
Improper Access Control
Details not found