CVE-2025-1863

Executive Summary

CVE-2025-1863 is a critical vulnerability affecting multiple Yokogawa Electric Corporation recorder and data acquisition products. The core issue is an insecure default configuration where authentication is disabled by default. This allows any unauthenticated attacker with network access to fully control the device, including modifying measurement data, settings, and operational parameters. The CVSS score of 9.8 reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code is currently available, but the vulnerability is trivially exploitable due to the lack of authentication. The vendor has not released a patch, making manual configuration changes the only mitigation.

Supply Chain & Package Security

This vulnerability is not related to software supply chain packages (NPM, PyPI, Go, Ruby). It is a firmware-level configuration issue in industrial control system (ICS) devices.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows complete device takeover without authentication. In an ICS/OT environment, this could lead to data manipulation, process disruption, or use as a pivot point for deeper network compromise.

Deep Dive & Mechanics

The vulnerability stems from the factory default configuration of the affected Yokogawa devices. When shipped, the authentication function is disabled. This means that any HTTP, FTP, or proprietary protocol interface exposed on the network does not require credentials. An attacker can:

1. Access the web interface to view and modify all settings.
2. Use FTP or other protocols to download/upload configuration files and recorded data.
3. Modify measurement values and alarm thresholds, potentially causing incorrect process control.
4. Disable logging or alter historical data to cover tracks.

The affected products include:

• GX10 / GX20 / GP10 / GP20 Paperless Recorders (firmware ≤ R5.04.01)
• GM Data Acquisition System (firmware ≤ R5.05.01)
• DX1000 / DX2000 / DX1000N Paperless Recorders (firmware ≤ R4.21)
• FX1000 Paperless Recorders (firmware ≤ R1.31)
• μR10000 / μR20000 Chart Recorders (firmware ≤ R1.51)
• MW100 Data Acquisition Units (all versions)
• DX1000T / DX2000T Paperless Recorders (all versions)
• CX1000 / CX2000 Paperless Recorders (all versions)

The vulnerability is not due to a software bug but a deliberate design choice that prioritizes ease of initial setup over security. This is a classic example of CWE-1188 (Insecure Defaults).

Vulnerable vs. Patched Code

Since this is a configuration issue, there is no "code" to compare. The vulnerable state is the default configuration with authentication disabled. The "patched" state is when authentication is enabled via the device's settings menu.

Vulnerable Configuration:

• Authentication: Disabled
• No password required for web/FTP access
• All functions accessible without login

Patched Configuration:

• Authentication: Enabled
• Password required for all access
• User roles and permissions enforced

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code exists, exploitation relies on direct interaction with the device's interfaces.

Step 1: Discovery Use Shodan or Nmap to find exposed Yokogawa devices.

nmap -p 80,443,21 --script http-title,ftp-anon <target_range>

Step 2: Access Web Interface Open a browser and navigate to the device's IP. No login prompt will appear.

GET / HTTP/1.1
Host: <target_ip>

Step 3: Modify Settings Navigate to configuration pages (e.g., /config, /settings) and change parameters. For example, to disable logging:

POST /config HTTP/1.1
Host: <target_ip>
Content-Type: application/x-www-form-urlencoded

logging=disabled&alarm_threshold=9999

Step 4: FTP Access (if enabled)

ftp <target_ip>
# No username/password required
get /config.dat
put malicious_config.dat /config.dat

Blue Team (Defense)

Detection:

• Monitor for connections to port 80/443/21 on Yokogawa devices from unexpected IPs.
• Look for HTTP requests without authentication headers.
• Check for configuration changes via syslog or SNMP traps.

Honeypot Setup: Deploy a low-interaction honeypot mimicking a Yokogawa recorder to detect scanning.

# Simple honeypot script (conceptual)
from http.server import BaseHTTPRequestHandler, HTTPServer

class YokogawaHoneypot(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type', 'text/html')
        self.end_headers()
        self.wfile.write(b'<html><body>Yokogawa Recorder - No Auth Required</body></html>')
        # Log the request
        with open('honeypot.log', 'a') as f:
            f.write(f'{self.client_address} - {self.path}\n')

HTTPServer(('0.0.0.0', 80), YokogawaHoneypot).serve_forever()

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unauthenticated HTTP requests to Yokogawa device IPs on ports 80/443.
  • FTP connections without authentication to port 21.
  • Unusual configuration changes (e.g., alarm thresholds set to extreme values).
• Host IOCs:
  • Device logs showing access from unknown IPs without login events.
  • Modified configuration files (e.g., config.dat with altered parameters).
• File IOCs:
  • Hashes of known default configuration files (if available from vendor).
• Behavioral IOCs:
  • Multiple failed login attempts (if authentication is later enabled) from the same IP.
  • Unusual data export patterns (e.g., large FTP downloads at odd hours).

Detection Engineering

YARA Rule

rule Yokogawa_Insecure_Default_Config {
    meta:
        description = "Detects default configuration files from Yokogawa recorders with authentication disabled"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-1863"
    strings:
        $auth_disabled = "authentication=disabled" nocase
        $default_config = "Yokogawa" nocase
    condition:
        $auth_disabled and $default_config
}

Sigma Rule

title: Unauthenticated Access to Yokogawa Recorder
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Yokogawa recorder web interfaces without authentication
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/config'
            - '/settings'
            - '/data'
        sc-status: 200
        cs-method: 'GET'
    condition: selection
falsepositives:
    - Legitimate initial setup by authorized personnel
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-1863 - Unauthenticated Access to Yokogawa Recorder"; flow:to_server; http.method; content:"GET"; http.uri; content:"/config"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Enable Authentication: Access the device's settings menu and enable password protection. Change the default password immediately.
2. Network Segmentation: Place Yokogawa devices on a separate VLAN with strict firewall rules. Do not expose them directly to the internet.
3. Disable Unused Services: Turn off FTP, Telnet, or other protocols if not required.
4. Monitor Logs: Enable and review device logs for unauthorized access attempts.

Long-Term Measures:

• Firmware Updates: Check Yokogawa's website for any future firmware updates that may address this default configuration.
• Vendor Communication: Contact Yokogawa support to request a secure-by-default firmware version.
• Configuration Management: Use a centralized tool to enforce secure configurations across all devices.
• Incident Response Plan: Update IR playbooks to include this specific vulnerability.

Workaround (if authentication cannot be enabled):

• Use a reverse proxy with authentication (e.g., Nginx with basic auth) in front of the device.
• Implement network access control (NAC) to restrict which IPs can reach the device.

Valters IT
DevSecOps & Cyber Threat Intelligence