CIO News Hubb
Advertisement
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact
No Result
View All Result
CIO News Hubb
No Result
View All Result
Home Information Security

CISA Warns of Multiple Critical Vulnerabilities Affecting Mitsubishi Electric PLCs

admin by admin
December 4, 2022
in Information Security


The U.S. Cybersecurity and Infrastructure Security Agency (CISA) this week released an Industrial Control Systems (ICS) advisory warning of multiple vulnerabilities in Mitsubishi Electric GX Works3 engineering software.

“Successful exploitation of these vulnerabilities could allow unauthorized users to gain access to the MELSEC iQ-R/F/L series CPU modules and the MELSEC iQ-R series OPC UA server module or to view and execute programs,” the agency said.

GX Works3 is an engineering workstation software used in ICS environments, acting as a mechanism for uploading and downloading programs from/to the controller, troubleshooting software and hardware issues, and performing maintenance operations.

CyberSecurity

The wide range of functions also makes the platform an attractive target for threat actors looking to compromise such systems to commandeer the managed PLCs.

Three of the 10 shortcomings relate to cleartext storage of sensitive data, four relate to the use of a hard-coded cryptographic key, two relate to the use of a hard-coded password, and one concerns a case of insufficiently protected credentials.

The most critical of the bugs, CVE-2022-25164, and CVE-2022-29830, carry a CVSS score of 9.1 and could be abused to gain access to the CPU module and obtain information about project files without requiring any permissions.

Nozomi Networks, which discovered CVE-2022-29831 (CVSS score: 7.5), said an attacker with access to a safety PLC project file could exploit the hard-coded password to directly access the safety CPU module and potentially disrupt industrial processes.

“Engineering software represents a critical component in the security chain of industrial controllers,” the company said. “Should any vulnerabilities arise in them, adversaries may abuse them to ultimately compromise the managed devices and, consequently, the supervised industrial process.”

The disclosure comes as CISA revealed details of a denial-of-service (DoS) vulnerability in Mitsubishi Electric MELSEC iQ-R Series that stems from a lack of proper input validation (CVE-2022-40265, CVSS score: 8.6).

“Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to cause a denial-of-service condition on a target product by sending specially crafted packets,” CISA noted.

In a related development, the cybersecurity agency further outlined three issues impacting Remote Compact Controller (RCC) 972 from Horner Automation, the most critical of which (CVE-2022-2641, CVSS score: 9.8) could lead to remote code execution or cause a DoS condition.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

You can now assign multiple MFA devices in IAM

Next Post

Initiativesofcapabilitycoherence

Related Posts

Information Security

New Russian-Backed Gamaredon’s Spyware Variants Targeting Ukrainian Authorities

by admin
February 2, 2023
Information Security

AWS achieves ISO 20000-1:2018 certification for 109 services

by admin
February 2, 2023
Information Security

Everything you need to know

by admin
February 2, 2023
Information Security

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

by admin
February 1, 2023
Information Security

How to set up ongoing replication from your third-party secrets manager to AWS Secrets Manager

by admin
February 1, 2023
Next Post

Initiativesofcapabilitycoherence

Recommended

Initiatetogoapproach

February 2, 2023

New Russian-Backed Gamaredon’s Spyware Variants Targeting Ukrainian Authorities

February 2, 2023

AWS achieves ISO 20000-1:2018 certification for 109 services

February 2, 2023

Everything you need to know

February 2, 2023

Influentialleadership ~ Future of CIO

February 1, 2023

Researchers Uncover New Bugs in Popular ImageMagick Image Processing Utility

February 1, 2023

© 2022 CIO News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

Newsletter Sign Up

No Result
View All Result
  • Home
  • News
  • Operations CIO
  • Visionary CIO
  • IT Management
  • Information Security
  • Contact

© 2022 CIO News Hubb All rights reserved.