Yokogawa Recorder Products
Plan PatchCVSS 9.8ICS-CERT ICSA-25-107-04Apr 17, 2025
YokogawaEnergyManufacturing
Summary
Multiple Yokogawa recorder and data acquisition products are vulnerable to unauthenticated information manipulation. The affected products include GX10/GX20/GP10/GP20, FX1000, μR10000/μR20000, GM Data Acquisition System, MW100 Data Acquisition Units, and DX/CX series paperless recorders. An attacker with network access can alter recorded process data, configuration, and historical records without providing credentials because authentication is disabled by default and no vendor fixes are available for these legacy products.
What this means
What could happen
An attacker with network access could manipulate data recorded and stored on these devices, potentially altering process records, alarm history, or production data without authentication, which could hide equipment failures, process deviations, or safety events from operators.
Who's at risk
Energy and manufacturing operations that rely on Yokogawa paperless recorders (GX10, GX20, GP10, GP20, FX1000, DX1000, DX2000, CX1000, CX2000 series), chart recorders (μR10000, μR20000), data acquisition systems (GM, MW100), and DX/CX series devices for process monitoring, data logging, and compliance record keeping.
How it could be exploited
An attacker on the network sends unauthenticated requests to the recorder's web interface or data management port. The device accepts requests without verifying the attacker's identity, allowing direct manipulation of stored information, configuration, or records.
Prerequisites
- Network access to the affected recorder device (direct or via plant network)
- No valid credentials required—authentication is disabled by default
Remotely exploitable over networkNo authentication required by defaultNo patch available (end-of-life products)Affects data integrity and audit trailsCould hide safety or process anomalies
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (8)
8 EOL
ProductAffected VersionsFix Status
GX10 / GX20 / GP10 / GP20 Paperless Recorders: vers:all/<=R5.04.01≤ R5.04.01No fix (EOL)
GM Data Acquisition System: vers:all/<=R5.05.01≤ R5.05.01No fix (EOL)
FX1000 Paperless Recorders: vers:all/<=R1.31≤ R1.31No fix (EOL)
μR10000 / μR20000 Chart Recorders: vers:all/<=R1.51≤ R1.51No fix (EOL)
MW100 Data Acquisition Units: vers:all/*All versionsNo fix (EOL)
DX1000T / DX2000T Paperless Recorders: vers:all/*All versionsNo fix (EOL)
CX1000 / CX2000 Paperless Recorders: vers:all/*All versionsNo fix (EOL)
DX1000 / DX2000 / DX1000N Paperless Recorders: vers:all/<=R4.21≤ R4.21No fix (EOL)
Remediation & Mitigation
0/5
Do now
0/3HARDENINGEnable the authentication (login) function on all affected Yokogawa recorder devices immediately
HARDENINGChange all default passwords to strong, unique credentials on each device after enabling authentication
HARDENINGRestrict network access to recorder devices using firewall rules—allow only authorized engineering workstations and HMI/SCADA servers on required ports
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HARDENINGImplement continuous data integrity monitoring or tamper detection on recorded process data to detect unauthorized changes
Mitigations - no patch available
0/1The following products have reached End of Life with no planned fix: GX10 / GX20 / GP10 / GP20 Paperless Recorders: vers:all/<=R5.04.01, GM Data Acquisition System: vers:all/<=R5.05.01, FX1000 Paperless Recorders: vers:all/<=R1.31, μR10000 / μR20000 Chart Recorders: vers:all/<=R1.51, MW100 Data Acquisition Units: vers:all/*, DX1000T / DX2000T Paperless Recorders: vers:all/*, CX1000 / CX2000 Paperless Recorders: vers:all/*, DX1000 / DX2000 / DX1000N Paperless Recorders: vers:all/<=R4.21. Apply the following compensating controls:
HARDENINGIsolate recorder devices and data acquisition systems on a separate VLAN from business networks and the internet
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/15f235b7-963b-4a62-9ac0-0b61cde55ad6Get OT security insights every Tuesday
Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.