Today, CISA’s NCCIC-ICS published one control system security advisory for products from Mitsubishi. They also published updates for two control system advisories for products from Mitsubishi and a medical device advisory for products from Philips.
Mitsubishi Advisory
This advisory describes four vulnerabilities in the ICONICS Product Suite and the Mitsubishi Electric MC Works64. The vulnerabilities are self-reported. ICONICS and Mitsubishi have new versions that mitigate the vulnerabilities.
The four reported vulnerabilities are:
Cross-site scripting - CVE-2022-23127,
Incomplete list of disallowed inputs - CVE-2022-23128,
Plaintext storage of a password - CVE-2022-23129, and
Buffer over-read - CVE-2022-23130
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to result in unauthorized access to information, unauthorized access to GENESIS64 and MC Works64 functionality, or the disabling of SQL Server.
NOTE: Mitsubishi published a separate advisory for each of the vulnerabilities, links included above.
Mitsubishi Update #1
This update contains additional information on an advisory that was originally published on December 8th, 2020 and was most recently updated on May 11th, 2021. The new information includes:
Updating affected versions for Tension Controller, and
Adding update procedures for Tension Controller.
Mitsubishi Update #2
This update contains additional information on an advisory that was originally published on May 11th, 2021. The new information includes:
Updating affected versions for LE7-40GU-L, and
Adding update procedures for LE7-40GU-L.
Philips Update
This update contains additional information on an advisory that was originally published on July 6th, 2021. The new information includes adding a new vulnerability (CVE-2021-39369), with mitigation measures, reported by Antonio Kulhanek.