CVE-2025-1924 Yokogawa Electric Corporation CVE debrief

Who should care

Industrial control system operators, OT engineers, and site administrators running Yokogawa CENTUM VP R6 or R7 with the Vnet/IP Interface Package should review this advisory, especially if the interface package is reachable from adjacent network segments.

Technical summary

The supplied advisory describes a packet-handling flaw in the Vnet/IP Interface Package for CENTUM VP. If the affected product receives maliciously crafted packets, the result may be a denial of service affecting Vnet/IP communication functions; the advisory also states arbitrary programs may be executed. The published CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H) indicates an adjacent-network attack with high availability impact and some integrity impact.

Defensive priority

High for OT networks where Vnet/IP communication availability is operationally critical. Even with an AC:H rating, disruption of communication functions can affect process monitoring and control, so patching and segmentation should be prioritized.

Recommended defensive actions

• Apply Yokogawa patch software R1.08.00 as recommended in the advisory.
• Confirm whether your environment uses the affected CENTUM VP R6 or R7 Vnet/IP Interface Package builds.
• Restrict adjacent-network access to the affected OT segment and reduce exposure of Vnet/IP communication paths.
• Monitor for unexpected crashes, communication interruptions, or abnormal packet-related instability on affected systems.
• Contact a local Yokogawa supporting office and follow the vendor advisory YSAR-26-0002 for implementation guidance.

Evidence notes

This debrief is based on the supplied CISA CSAF source for ICSA-26-057-09 (republishing YSAR-26-0002) and the accompanying official links. The source states that maliciously crafted packets can stop Vnet/IP communication functions or allow arbitrary programs to be executed, and that patch software R1.08.00 is the vendor-recommended mitigation. No KEV listing was provided in the supplied corpus.

Official resources