CVE-2014-3888

Yokogawa CENTUM CS 1000-VP - Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2014-3888. PoCs published by Metasploit, including Metasploit module exploits/windows/scada/yokogawa_bkfsim_vhfd.

AI-analyzed exploit summary This Metasploit module exploits a stack-based buffer overflow in Yokogawa CS3000's BKFSim_vhfd.exe service via a maliciously crafted UDP packet. It leverages insecure use of functions like vsprintf and memcpy to achieve remote code execution.

Description

Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000 R3.09.50 and earlier, CENTUM VP R5.03.20 and earlier, Exaopc R3.72.00 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier, when FCS/Test Function is enabled, allows remote attackers to execute arbitrary code via a crafted packet.

Exploits (2)

exploitdb WORKING POC
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/34009

This Metasploit module exploits a stack-based buffer overflow in Yokogawa CS3000's BKFSim_vhfd.exe service via a maliciously crafted UDP packet. It leverages insecure use of functions like vsprintf and memcpy to achieve remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Yokogawa Centum CS3000 R3.08.50
No auth needed
Prerequisites: Network access to UDP port 20010 · Target system running vulnerable Yokogawa CS3000 software
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/yokogawa_bkfsim_vhfd.rb

This Metasploit module exploits a stack-based buffer overflow in Yokogawa CS3000's BKFSim_vhfd.exe service via a maliciously crafted UDP packet. It leverages insecure use of functions like vsprintf and memcpy to achieve remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Yokogawa Centum CS3000 R3.08.50
No auth needed
Prerequisites: Network access to UDP port 20010 · Target system running vulnerable Yokogawa CS3000 version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (5)

Core 5
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
http://www.exploit-db.com/exploits/34009
Third Party Advisory, US Government Resource x_refsource_misc
http://ics-cert.us-cert.gov/advisories/ICSA-14-189-01
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/show/osvdb/108756

Scores

EPSS 0.6231
EPSS Percentile 99.1%

Details

CWE
CWE-119
Status published
Products (17)
yokogawa/b\/m9000_vp
yokogawa/b\/m9000_vp_software < 7.03.01
yokogawa/b\/m9000cs
yokogawa/b\/m9000cs_software < 5.05.01
yokogawa/centum_cs_1000
yokogawa/centum_cs_1000_software
yokogawa/centum_cs_3000
yokogawa/centum_cs_3000_entry_class
yokogawa/centum_cs_3000_entry_class_software < 3.09.50
yokogawa/centum_cs_3000_software < 2.23.00
... and 7 more
Published Jul 10, 2014
Tracked Since Feb 18, 2026