CVE-2025-1863: Default Authentication Function Disabled in Yokogawa Recorder Products

Overview

The world of cybersecurity is an ever-evolving battleground, and vulnerabilities are discovered and patched regularly. The latest vulnerability, identified as CVE-2025-1863, directly affects the recorder products provided by Yokogawa Electric Corporation. This flaw lies in the insecure default settings where the authentication function is disabled, providing potential unauthorized access to critical system functions and data. This vulnerability poses a significant risk to any organization employing these products, potentially leading to system compromise and data leakage.

Vulnerability Summary

CVE ID: CVE-2025-1863
Severity: Critical (CVSS Score: 9.8)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Unauthorized access to system functions and data, potential system compromise or data leakage

Affected Products

Product | Affected Versions

GX10 / GX20 / GP10 / GP20 Paperless Recorders | R5.04.01 or earlier
GM Data Acquisition System | R5.05.01 or earlier
DX1000 / DX2000 / DX1000N Paperless Recorders | R4.21 or earlier
FX1000 Paperless Recorders | R1.31 or earlier
μR10000 / μR20000 Chart Recorders | R1.51 or earlier
MW100 Data Acquisition Units | All versions
DX1000T / DX2000T Paperless Recorders | All versions
CX1000 / CX2000 Paperless Recorders | All versions

How the Exploit Works

The vulnerability arises from the insecure default settings in various Yokogawa recorder products. By default, the authentication function is disabled, allowing anyone on the network to access all settings and operations-related functions without any necessary credentials. An attacker can exploit this vulnerability by connecting to the network and manipulating important data such as measured values and settings.

Conceptual Example Code

The following conceptual example demonstrates how the vulnerability might be exploited:

GET /settings HTTP/1.1
Host: vulnerable.yokogawa.com

This example illustrates a simple HTTP GET request made to the settings endpoint of a vulnerable Yokogawa product. Given the lack of authentication, an attacker could potentially access, view, and manipulate these settings without needing any form of credentials.
Please note that this is a conceptual example and may not represent the actual exploit code that an attacker might use. This example is intended to provide a basic understanding of how such an exploit could function.