Centum Vp EUVD-2025-209116

Real-world risk is mitigated by multiple factors. First, CVSS score and vector are not provided by the vendor, limiting quantitative comparison; however, CWE-259 (hardcoded password) typically yields CVSS 7-9 range depending on privileges granted. Second, the default PROG permission level (S1/OFFUSER) is read-only or low-privilege, preventing critical operations or configuration changes without further privilege escalation. Third, and most significantly, exploitation requires pre-existing HIS access-the vendor explicitly notes that an attacker with HIS access can already operate and monitor the system, rendering the PROG credential largely redundant for initial compromise. The vulnerability becomes high-risk only if: (a) the PROG account has been granted elevated permissions beyond S1 default, or (b) it serves as a stepping stone to lateral movement within the CENTUM environment. No KEV status, POC, or exploitation-in-the-wild reports are present, suggesting low active threat at publication. Organizations with default PROG permissions face lower priority; those with custom elevated permissions for PROG require immediate patching.

An attacker with network access to or physical presence at a CENTUM VP Human Interface Station obtains the hardcoded PROG password through source code analysis, vendor leak, or shared documentation. The attacker connects to or logs into the HIS and enters the PROG credentials to authenticate. If the HIS is in CTM mode and the PROG account retains its default S1 permission set, the attacker gains read-only or low-privilege monitoring access; this attack is primarily valuable for persistence or credential harvesting rather than immediate operational impact. However, if the PROG account has been assigned elevated permissions by the site operator, the attacker could then perform configuration changes or operational commands, potentially disrupting production. No public proof-of-concept code is known to exist at publication.