CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

This week, the United States Cybersecurity and Infrastructure Security Agency (CISA) issued an ICS advisory warning of multiple vulnerabilities in the engineering software developed by Mitsubishi Electric called GX Works3.

The agency warned that attackers could gain access to the MELSEC iQ-R/F/L series CPU modules and the MELSEC iQ-R/F/L series OPC UA server module and even run arbitrary code if they were able to successfully exploit the flaws.

ALSO, READ Researchers Disclose Details of Critical ‘CosMiss’ RCE Flaw Affecting Azure Cosmos DB

In ICS settings, engineers rely on GX Works3, a piece of engineering workstation software that facilitates the transfer of programs to and from the controller, diagnosis of software and hardware problems, and execution of maintenance tasks.

The versatility of the platform makes it a tempting target for adversaries who are out to take control of the managed PLCs through compromise.

Three of the ten flaws are related to the storage of sensitive data in cleartext, four are related to the use of a hard-coded cryptographic key, two are related to the use of a hard-coded password, and one is related to a case of insufficiently protected credentials.

CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

The most critical of the bugs, CVE-2022-25164, and CVE-2022-29830, carry a CVSS score of 9.1 and could be abused to gain access to the CPU module and obtain information about project files without requiring any permissions.

ALSO, READ Top 10 Best Cyber Security Agencies In USA 202

Nozomi Networks, which discovered CVE-2022-29831 (CVSS score: 7.5), said an attacker with access to a safety PLC project file could exploit the hard-coded password to directly access the safety CPU module and potentially disrupt industrial processes.

“Engineering software represents a critical component in the security chain of industrial controllers,” the company said. “Should any vulnerabilities arise in them, adversaries may abuse them to ultimately compromise the managed devices and, consequently, the supervised industrial process.”

The disclosure comes as CISA revealed details of a denial-of-service (DoS) vulnerability in Mitsubishi Electric MELSEC iQ-R Series that stems from a lack of proper input validation (CVE-2022-40265, CVSS score: 8.6).

ALSO, READ Staying Safe Online While Working Remotely (2022)

“Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to cause a denial-of-service condition on a target product by sending specially crafted packets,” CISA noted.

CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

The cybersecurity agency also detailed three vulnerabilities affecting Horner Automation’s Remote Compact Controller (RCC) 972, the worst of which (CVE-2022-2641, CVSS score: 9.8) could allow for remote code execution or cause a denial of service.

CYBERINFORMER.NET –  brings updates on the latest cyber security tips, online safety tips and cyber information, cyber security courses for Nigerians and Foreigners, Cyber security jobs for seekers and much more…