Yokogawa CENTUM VP DCS: Security Vulnerabilities, Attack Surface, and Hardening

Yokogawa’s CENTUM VP is a distributed control system deployed across thousands of facilities in oil and gas refining, petrochemical processing, power generation, and pharmaceutical manufacturing. Its installed base makes it one of the most consequential DCS platforms in terms of sector-wide OT security exposure. Like most DCS platforms with roots in pre-connectivity operational designs, CENTUM VP’s security posture reflects design priorities from an era when isolated networks were assumed — and those assumptions have not aged well.

This article covers the documented vulnerability landscape, the principal attack surface components, and the hardening steps operators should prioritise.

CENTUM VP Architecture Overview

CENTUM VP’s architecture centres on:

FCS (Field Control Station): The process controller. Executes control logic, manages I/O connections to field instrumentation and actuators.
HIS (Human Interface Station): Operator workstation. Windows-based, runs CENTUM VP client software, connects to FCS via the VNET/IP control network.
EWS (Engineering Workstation): Windows-based workstation used for control logic development, configuration, and download to FCS.
Exaopc: Yokogawa’s OPC server software, providing an OPC DA/OPC UA interface that exposes CENTUM VP process data to historian systems, MES layers, and third-party applications.
VNET/IP: Yokogawa’s proprietary control network protocol running over standard Ethernet/IP infrastructure, connecting HIS, EWS, and FCS components.

Documented Vulnerabilities

VNET/IP Protocol

VNET/IP, the backbone communication protocol between CENTUM VP components, was designed without authentication. Communications between HIS, EWS, and FCS use the protocol without cryptographic verification of message origin or integrity. An attacker with access to the CENTUM VP network segment can:

Issue commands to FCS controllers without credentials
Inject or replay legitimate-looking VNET/IP packets
Enumerate connected FCS stations and their configuration

CISA has issued advisories (including ICSA-22-013-02 and related updates) documenting the authentication gap. Yokogawa has acknowledged the issue and has addressed it in more recent platform versions with CENTUM VP R6.11 and later releases introducing network-layer security options. Older deployed instances remain exposed.

Exaopc OPC Server

Exaopc exposes CENTUM VP process data through OPC interfaces to enterprise-layer systems. Its DCOM-based architecture (for OPC DA) introduces a historically wide Windows attack surface. Documented concerns:

DCOM configuration: OPC DA relies on Windows DCOM, which requires complex network permission configurations. Misconfigured DCOM permissions are a persistent source of unintended network access.
OPC UA endpoint exposure: Exaopc’s OPC UA interface should be network-restricted to authorised historian and MES systems. Operators sometimes expose the endpoint more broadly during integration and fail to restrict it afterwards.
Authentication: OPC DA authentication relies on Windows authentication. If the Exaopc host is domain-joined and domain security is compromised, OPC access follows. OPC UA requires explicit certificate-based authentication configuration; default configurations often leave this incomplete.

CISA advisory ICSA-21-019-04 documented specific vulnerabilities in Exaopc versions prior to R3.05.00, including stack buffer overflows in the OPC server component that could lead to remote code execution. Operators should verify Exaopc version currency.

HIS and EWS Workstations

The Human Interface Station and Engineering Workstation are Windows-based. Their security posture is constrained by two factors endemic to DCS deployments:

Legacy Windows versions: Many operational CENTUM VP deployments run HIS on Windows 7, Windows Server 2008 R2, or Windows 10 LTSC versions that have exited mainstream support. Yokogawa’s support and compatibility matrix limits OS upgrade options for older CENTUM VP releases. Extended Security Updates (where available) partially mitigate this, but the patch surface remains constrained.

Privileged access requirements: CENTUM VP client software typically requires elevated Windows privileges to interact with control system hardware. The principle of least privilege is difficult to apply in practice, which means an attacker who compromises a local user account on an HIS can often escalate to the access needed to interact with the DCS.

USB and removable media: EWS workstations routinely require USB media for software maintenance and configuration transfers. This creates an infection vector that has been exploited in industrial environments historically.

Network Architecture Attack Surface

CENTUM VP deployments that have evolved over time often have network architecture gaps:

Direct HIS-to-IT connectivity: HIS workstations that have both VNET/IP network access and connections to enterprise IT networks (for historian data forwarding, remote access, or engineering support) become bridge points between the networks.
Remote access to EWS: Engineering workstations often have remote access configured for Yokogawa support. If this access uses jump servers without MFA or certificate-based authentication, it represents an externally accessible path to the control network.
Historian connections: Historian servers (PI, OSIsoft) that receive data from Exaopc often have bidirectional network access, and historian platforms have their own vulnerability histories.

Hardening Priorities

1. Network Segmentation and Isolation

The VNET/IP network should be isolated from enterprise IT networks with no direct routing. Data exchange between the control system and enterprise systems should pass through a demilitarised zone or data diode, not through direct network connections.

Deploy unidirectional gateways (data diodes) for historian data transfer where operationally feasible
Ensure no HIS or EWS has simultaneous active connections to both VNET/IP and enterprise network segments
Apply deny-by-default ACLs on any firewall between the control network and external segments; whitelist only the specific ports and IP addresses required

2. Upgrade CENTUM VP to Supported Releases

Yokogawa’s CENTUM VP R6.11 and later introduce network security enhancements including authentication options for VNET/IP communication. Operators on older releases should assess the feasibility of upgrading.

Where upgrade is not immediately feasible, compensating controls should be documented: network monitoring on the VNET/IP segment, ICS-specific intrusion detection (Claroty, Dragos, Nozomi) that understands VNET/IP and can detect anomalous FCS commands.

3. Patch Exaopc and HIS/EWS

Ensure Exaopc is at or above R3.05.00 (addresses known RCE vulnerabilities)
Apply all Windows security updates available and compatible with the CENTUM VP version
For HIS/EWS on end-of-life Windows: engage Yokogawa for supported migration paths; if migration is not possible in the near term, apply compensating controls (application whitelisting, USB lockdown, network restriction)

4. Harden Exaopc OPC Configuration

Restrict the Exaopc OPC UA endpoint to specific authorised client IP addresses at the firewall level
Configure OPC UA with certificate-based authentication; do not leave anonymous access enabled
Audit DCOM security permissions and restrict them to minimum required access
Monitor Exaopc for anomalous connection patterns, particularly connections from unexpected source addresses or outside operational hours

5. Remote Access Controls

Audit all remote access paths to EWS and HIS — Yokogawa vendor access, engineering contractor access, remote monitoring
Require MFA for all remote access sessions
Implement a privileged access workstation (PAW) or jump server architecture that logs all sessions
Time-limit remote access grants rather than maintaining persistent always-on connectivity

6. USB and Media Control

Apply application whitelisting on HIS and EWS to prevent execution of unauthorized software
Implement USB access controls: allow only specific authorised devices, log all USB connections
Establish a sanitisation procedure for media transferred to EWS from external sources

7. OT Network Monitoring

Deploy passive network monitoring on the VNET/IP segment using ICS-aware tools. Establish baselines for normal FCS command patterns, normal polling cadence from HIS stations, and normal Exaopc query volumes. Alert on deviations: novel source addresses on VNET/IP, unusual FCS write commands, bulk Exaopc queries outside normal hours.

Operational Considerations

Hardening a live CENTUM VP deployment involves operational risk that doesn’t exist in IT environments. Network reconfigurations, patch applications, and segmentation changes should be staged through factory acceptance testing before production application, with rollback procedures in place.

Engage Yokogawa’s OT security team (YSSA — Yokogawa Security Support and Advisory) early in any hardening programme. Yokogawa provides specific guidance for CENTUM VP security hardening and can advise on compatibility constraints for specific deployment configurations.

The priority ordering above reflects practical sequencing: network segmentation provides the highest risk reduction for the broadest class of attacks, and it can typically be implemented without CENTUM VP downtime. Software patching requires maintenance windows and carries restart risk. Remote access controls close a high-priority external exposure path.