Raw vector
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-1924 is a medium-severity Wrap or Wraparound (CWE-191) vulnerability in Yokogawa Vnet\/Ip Interface Package. Its CVSS base score is 6.0 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Devices (T1584.008); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-1924 is a vulnerability in the Vnet/IP Interface Package provided by Yokogawa Electric Corporation. It affects versions R1.07.00 or earlier of the package when used with CENTUM VP R6 VP6C3300 or CENTUM VP R7 VP7C3300. Receipt of maliciously crafted packets can result in a denial-of-service condition that stops Vnet/IP communication functions or enables execution of arbitrary programs. The vulnerability is associated with CWE-191 and CWE-787, and it has a CVSS v3.1 base score of 8.2 (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H).
An attacker on an adjacent network can exploit this vulnerability with low complexity and no required privileges or user interaction. By sending specially crafted packets to affected products, the attacker can achieve high scope impact, leading to high availability disruption through DoS on Vnet/IP communications, low integrity impact, or arbitrary program execution, while confidentiality remains unaffected.
Yokogawa has published security advisory YSAR-26-0002-E, available at https://web-material3.yokogawa.com/1/39281/files/YSAR-26-0002-E.pdf, which provides further details on the vulnerability. Security practitioners should consult this advisory for mitigation and patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207003
Vulnerability Data
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receive maliciously crafted packets, a DoS attack may cause Vnet/IP communication functions to stop or arbitrary programs to be executed. The affected products…
more
and versions are as follows: Vnet/IP Interface Package (for CENTUM VP R6 VP6C3300, CENTUM VP R7 VP7C3300) R1.07.00 or earlier
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and static/dynamic analysis directly find integer underflow defects before code is released.
Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.
Security engineering principles require use of safe arithmetic constructs or language features that structurally eliminate integer underflow during subtraction.
Input validation can reject or sanitize values that would cause a subtraction to underflow the representable range.
Memory-protection mechanisms limit the exploitability and blast radius of a successful out-of-bounds write.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent integer underflow defects via input validation, bounds checking, and static analysis.
Vulnerability scanning and code analysis can surface underflow flaws after they are introduced.
Routine patching can remediate known underflow bugs once they are discovered in deployed software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches integer underflow defects before release.
Secure coding standards directly prescribe safe integer handling and overflow/underflow prevention.