CVE-2025-1863: Yokogawa Recorders Auth Bypass Vulnerability

CVE-2025-1863 Overview

CVE-2025-1863 is a critical insecure default configuration vulnerability affecting multiple industrial recorder and data acquisition products manufactured by Yokogawa Electric Corporation. The authentication function is disabled by default on affected devices, allowing unauthenticated remote attackers to access all device functions including settings and operations when connected to a network with default settings. This vulnerability could enable attackers to illegally manipulate and configure important data such as measured values and settings.

Critical Impact

Unauthenticated remote attackers can fully control affected industrial recording devices, manipulating critical measurement data and device configurations without any authentication.

Affected Products

• GX10 / GX20 / GP10 / GP20 Paperless Recorders: R5.04.01 or earlier
• GM Data Acquisition System: R5.05.01 or earlier
• DX1000 / DX2000 / DX1000N Paperless Recorders: R4.21 or earlier
• FX1000 Paperless Recorders: R1.31 or earlier
• μR10000 / μR20000 Chart Recorders: R1.51 or earlier
• MW100 Data Acquisition Units: All versions
• DX1000T / DX2000T Paperless Recorders: All versions
• CX1000 / CX2000 Paperless Recorders: All versions

Discovery Timeline

• 2025-04-18 - CVE-2025-1863 published to NVD
• 2025-04-21 - Last updated in NVD database

Technical Details for CVE-2025-1863

Vulnerability Analysis

This vulnerability stems from insecure default settings in Yokogawa's industrial recorder product line. The affected devices ship with authentication disabled by default, creating an immediate security risk when these devices are deployed on network-accessible environments without proper hardening. Industrial Control System (ICS) devices like these recorders are often deployed in critical infrastructure environments including manufacturing plants, utilities, and process control facilities where data integrity is paramount.

When authentication is disabled, any network-accessible attacker can interact with the device's full functionality without credentials. This includes the ability to modify recorded measurement data, alter device configurations, and potentially disrupt industrial processes that rely on accurate data collection. The impact extends beyond simple data manipulation—compromised recorder data could mask equipment failures, falsify compliance records, or enable subsequent attacks on connected industrial systems.

Root Cause

The root cause is classified as CWE-1188 (Initialization with Hard-Coded Network Resource Configuration Settings). Yokogawa designed these products with authentication disabled as the factory default configuration, prioritizing ease of deployment over security-by-default principles. This design decision creates significant risk when devices are connected to networks without explicit security hardening by administrators.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the affected device can directly access all device functions including:

• Reading and modifying recorded measurement data
• Changing device configuration parameters
• Altering operational settings
• Potentially disrupting data acquisition processes

Due to the network-accessible nature of this vulnerability combined with the lack of authentication requirements, exploitation is straightforward for any attacker who can reach the device on the network. Industrial environments with flat network architectures or insufficient segmentation are particularly at risk.

Detection Methods for CVE-2025-1863

Indicators of Compromise

• Unexpected configuration changes on Yokogawa recorder devices
• Unauthorized access attempts or connections to device management interfaces
• Modified measurement values or historical data anomalies
• Network traffic to recorder devices from unexpected source addresses

Detection Strategies

• Monitor network traffic to and from Yokogawa recorder devices for unauthorized access patterns
• Implement asset inventory scanning to identify devices running vulnerable firmware versions
• Deploy network intrusion detection systems (IDS) with signatures for unauthorized industrial protocol access
• Review device audit logs for configuration changes or data modifications

Monitoring Recommendations

• Establish network baselines for normal communication patterns with recorder devices
• Configure alerts for any new connections to device management interfaces
• Monitor for bulk data access or configuration export operations
• Implement continuous security monitoring for ICS/SCADA network segments containing these devices

How to Mitigate CVE-2025-1863

Immediate Actions Required

• Enable authentication on all affected Yokogawa recorder devices immediately
• Isolate affected devices on segmented network zones with restricted access
• Implement firewall rules to limit access to device management interfaces
• Audit recent device configurations and recorded data for signs of tampering
• Review network architecture to ensure proper ICS network segmentation

Patch Information

Yokogawa Electric Corporation has released security advisory YSAR-25-0001 addressing this vulnerability. For devices with available firmware updates, organizations should upgrade to the following minimum versions:

• GX10 / GX20 / GP10 / GP20 Paperless Recorders: Versions after R5.04.01
• GM Data Acquisition System: Versions after R5.05.01
• DX1000 / DX2000 / DX1000N Paperless Recorders: Versions after R4.21
• FX1000 Paperless Recorders: Versions after R1.31
• μR10000 / μR20000 Chart Recorders: Versions after R1.51

For MW100, DX1000T/DX2000T, and CX1000/CX2000 devices where all versions are affected, refer to the Yokogawa Security Advisory YSAR-25-0001 for specific mitigation guidance.

Workarounds

• Enable the built-in authentication function on all affected devices to prevent unauthorized access
• Implement network segmentation to isolate recorder devices from untrusted networks
• Use VPN or other secure access methods for remote management
• Deploy firewalls or access control lists to restrict network access to authorized management stations only
• Consider physical network isolation for devices where authentication cannot be enabled

# Network segmentation example using iptables to restrict access to recorder devices
# Replace 10.0.1.0/24 with your recorder network segment
# Replace 192.168.100.50 with your authorized management station IP

# Drop all incoming connections to recorder subnet by default
iptables -A FORWARD -d 10.0.1.0/24 -j DROP

# Allow only authorized management station to access recorders
iptables -I FORWARD -s 192.168.100.50 -d 10.0.1.0/24 -j ACCEPT

# Log unauthorized access attempts
iptables -I FORWARD -d 10.0.1.0/24 -j LOG --log-prefix "YOKOGAWA-RECORDER-ACCESS: "