by Kastro
Paper/Archive/CVE-2025-1863

CVE-2025-1863

Yokogawa Electric Corporation GX10 / GX20 / GP10 / GP20 Paperless Recorders — Insecure default settings for recorder products

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.1.551 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings. This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.

Affected

ProductAffectedFixed inSource
GX10 / GX20 / GP10 / GP20 Paperless RecordersR5.04.01 or earlier–CNA
GM Data Acquisition SystemR5.05.01 or earlier–CNA
DX1000 / DX2000 / DX1000N Paperless RecordersR4.21 or earlier–CNA
FX1000 Paperless RecordersR1.31 or earlier–CNA
μR10000 / μR20000 Chart RecordersR1.51 or earlier–CNA
MW100 Data Acquisition UnitsAll versions–CNA
DX1000T / DX2000T Paperless RecordersAll versions–CNA
CX1000 / CX2000 Paperless RecordersAll versions–CNA

Scores by source

YokogawaGroup (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refweb-material3.yokogawa.com/1/36974/files/YSAR-25-0001-E.pdf