CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
this week released an Industrial Control Systems (ICS) advisory
warning of multiple vulnerabilities in Mitsubishi Electric GX
Works3 engineering software.

“Successful exploitation of these vulnerabilities could allow
unauthorized users to gain access to the MELSEC iQ-R/F/L series CPU
modules and the MELSEC iQ-R series OPC UA server module or to view
and execute programs,” the agency said^[1].

GX Works3^[2]
is an engineering workstation^[3]
software used in ICS environments, acting as a mechanism for
uploading and downloading programs from/to the controller,
troubleshooting software and hardware issues, and performing
maintenance operations.

The wide range of functions also makes them an attractive target
for threat actors looking to compromise such systems to commandeer
the managed PLCs^[4].

Three of the 10 shortcomings relate to cleartext storage of
sensitive data, four relate to the use of a hard-coded
cryptographic key, two relate to the use of a hard-coded password,
and one concerns a case of insufficiently protected
credentials.

The most critical of the bugs, CVE-2022-25164^[5], and CVE-2022-29830^[6], carry a CVSS score of
9.1 and could be abused to gain access to the CPU module and obtain
information about project files without requiring any
permissions.

Nozomi Networks, which discovered CVE-2022-29831^[7]
(CVSS score: 7.5), said an attacker with access to a safety PLC
project file could exploit the hard-coded password to directly
access the safety CPU module and potentially disrupt industrial
processes.

“Engineering software represents a critical component in the
security chain of industrial controllers,” the company said^[8]. “Should any
vulnerabilities arise in them, adversaries may abuse them to
ultimately compromise the managed devices and, consequently, the
supervised industrial process.”

The disclosure comes as CISA revealed^[9]
details of a denial-of-service (DoS) vulnerability in Mitsubishi
Electric MELSEC iQ-R Series that stems from a lack of proper input
validation (CVE-2022-40265^[10], CVSS score: 8.6).

“Successful exploitation of this vulnerability could allow a
remote unauthenticated attacker to cause a denial-of-service
condition on a target product by sending specially crafted
packets,” CISA noted.

In a related development, the cybersecurity agency further
outlined three issues impacting Remote Compact Controller (RCC) 972
from Horner Automation, the most critical of which (CVE-2022-2641^[11], CVSS score: 9.8) could
lead to remote code execution or cause a DoS condition.