Today CISA’s NCCIC-ICS published a control system security advisory for products from Mitsubishi.
Mitsubishi Advisory
The advisory describes a null pointer dereference vulnerability in the Mitsubishi MELSEC-F Series Ethernet interface block. The vulnerability is self-reported. Mitsubishi has a new firmware version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a denial-of-service condition in communication with the product. System reset may be required for recovery.
Microsoft Security Concern
Last week I reported that I had been receiving a Microsoft security warning when I tried to copy and paste the Industrial Control System web page to a MS Word® document. Today, I did not receive the warning, MS Word handled the page copy just like it has done for every other site I have copied. I am not sure if it was a CISA web site issue, a MS Word issue, or some odd combination of both. In any case, it is apparently corrected.
According to Dale Peterson there is a related talk on insecure by design by TXOne at Defcon talk in a couple of weeks