CVE-2025-1863

Insecure default settings for recorder products

State
Published
Severity
9.8 Critical
Published
Apr 18, 2025
Updated
Apr 18, 2025
Reserved
Mar 3, 2025

Read the record on cve.org

Description

Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is disabled on the affected products. Therefore, when connected to a network with default settings, anyone can access all functions related to settings and operations. As a result, an attacker can illegally manipulate and configure important data such as measured values and settings. This issue affects GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier; GM Data Acquisition System: R5.05.01 or earlier; DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier; FX1000 Paperless Recorders: R1.31 or earlier; μR10000 / μR20000 Chart Recorders: R1.51 or earlier; MW100 Data Acquisition Units: All versions; DX1000T / DX2000T Paperless Recorders: All versions; CX1000 / CX2000 Paperless Recorders: All versions.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HYokogawaGroup

Weaknesses

  • CWE-1188 Insecure Default Initialization of Resource

Affected Products

ProductVersions
GX10 / GX20 / GP10 / GP20 Paperless RecordersYokogawa Electric Corporation
  • R5.04.01 or earlierAffected
GM Data Acquisition SystemYokogawa Electric Corporation
  • R5.05.01 or earlierAffected
DX1000 / DX2000 / DX1000N Paperless RecordersYokogawa Electric Corporation
  • R4.21 or earlierAffected
FX1000 Paperless RecordersYokogawa Electric Corporation
  • R1.31 or earlierAffected
μR10000 / μR20000 Chart RecordersYokogawa Electric Corporation
  • R1.51 or earlierAffected
MW100 Data Acquisition UnitsYokogawa Electric Corporation
  • All versionsAffected
DX1000T / DX2000T Paperless RecordersYokogawa Electric Corporation
  • All versionsAffected
CX1000 / CX2000 Paperless RecordersYokogawa Electric Corporation
  • All versionsAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.