New S2SC70S/S2SC70D Control Unit

New S2SC70S/S2SC70D Control Unit

Replace SSC50D, SSC60D

Control unit:SSC60S, SSC60D, S2SC70S, S2SC70D

AFV30S, AFV30D, AFV40S, AFV40D,
A2FV50S, A2FV50D, A2FV70S, A2FV70D，AFV10S, AFV10D。AFF50S, AFF50D, AFF30S, AFF30D，AFG30S, AFG30D, AFG40S, AFG40D,
AFS30S, AFS30D, AFS40S, AFS40D,
AFG10S, AFG10D, AFG20S, AFG20D,
AFS10S, AFS10D, AFS20S, AFS20D

PFCS-E, PFCD-E，PFCS-S, PFCD-S

SSC50S, SSC50D, SSC57S, SSC57D

SSC10S, SSC10D

Vulnerability Overview

A vulnerability known as Meltdown/Spectre has been discovered in multiple CPUs, including Intel, AMD, and ARM processors (*). If an attack exploiting this vulnerability occurs, there is a risk of reading the memory contents of programs that were not initially allowed, as well as leaking passwords and other confidential information. For detailed information about this vulnerability, please refer to the following website.

Vulnerability Description VU # 584653 CPU Hardware Vulnerable to Side Channel Attacks

The impact on Yokogawa products equipped with CPUs

CENTUM VP/CS 3000 Controller FCS

The following table shows the impact of the completed survey on the FCS processor module.

ProSafe RS Controller SCS

The following table shows the impact of SCS on processor modules that have been investigated.

Other Yokogawa products

Yokogawa is currently investigating Yokogawa products equipped with CPUs affected by this vulnerability.

When it is possible to provide countermeasures for products affected by this vulnerability, Yokogawa will provide information on such products and countermeasures in the form of Yokogawa Security Advisory Reports (YSARs).

Yokogawa Safety Advisory Report (YSAR)

Microsoft Windows environment

Countermeasures for this vulnerability

Microsoft has provided the following information on countermeasures to address this vulnerability. For detailed information, please refer to the reference provided below.

Apply the latest Microsoft software updates.

Apply the firmware update program provided by the PC/Server vendor.

Set registry key to enable countermeasures against this vulnerability (Windows Server only).

PC/server performance degradation

There are reports that due to the implementation of the above measures, the performance of PC/servers has declined. The degree of performance degradation varies depending on the customer's system environment. Therefore, Yokogawa strongly recommends conducting checks to verify operational performance in customer environments before applying these measures to all customer system environments.

Joint validation of Microsoft software updates and Yokogawa control system products

Yokogawa conducted joint validation of Microsoft software updates in the standard testing environment for Yokogawa control system products. The verification result report is provided through the "Security Information Service" in our endpoint security service.

Endpoint Security Service

Other mitigation measures

Attackers cannot directly exploit this vulnerability through the network. To exploit this vulnerability, attackers must infiltrate the target PC/Server. Therefore, by installing security measures such as antivirus software and whitelist software on the target PC/Server, the risk of attackers exploiting this vulnerability can be reduced.

Yokogawa provides antivirus software and whitelist software for Yokogawa control system products based on McAfee products.

Anti virus software (AV11000) and whitelist software (SS1WL1) for Yokogawa Control System products

A report from Microsoft suggests that in some cases, combining Microsoft software updates aimed at mitigating this vulnerability with some security countermeasure software may result in a "blue screen" error. Therefore, Microsoft requires compatibility testing to verify the compatibility of relevant Microsoft software updates with such security software.

Yokogawa has confirmed that there is no such risk in the latest version of the antivirus software and whitelist software for Yokogawa Control System products. For detailed information, please use the following contact information to inquire.