2 Advisories and 1 Update Published – 2-28-23

Today, CISA’s NCCIC-ICS published two control system security advisories for products from Hitachi. They also updated an advisory for products from Mitsubishi.

Hitachi Advisory #1

This advisory describes three vulnerabilities in the Hitachi Gateway Station (GWS). The vulnerabilities are self-reported. Hitachi has a new version that mitigates the vulnerabilities.

The three reported vulnerabilities are:

• Improper input validation - CVE-2022-2277 and CVE-2022-29922, and

• Classic buffer overflow - CVE-2022-1778

NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause part of GWS fail to start, allow unauthorized actors to run scripts, and/or cause a denial-of-service condition.

NOTE: I briefly reported on these vulnerabilities on February 18^th, 2023. The Hitachi advisory included an additional improper input validation vulnerability - CVE-2022-29492.

Hitachi Advisory #2

This advisory describes two vulnerabilities in the Hitachi Gateway Station (GWS). The vulnerabilities were self-reported. Hitachi has a new version that mitigates the vulnerabilities.

The two reported vulnerabilities are:

• NULL pointer dereference - CVE-2020-25692,

• Infinite loop - CVE-2022-2277

NOTE: I briefly reported on these vulnerabilities on February 18^th, 2023. I discussed ten additional Hitachi advisories in that post.

Mitsubishi Update

This update provides additional details on an advisory that was originally published on May 19^th, 2022 and most recently updated on May 31^st, 2022. Mitsubishi removed FX5S CPU module from the list of affected products on their update.

NOTE 1: NCCIC-ICS published an ‘Update A’ for this advisory back on May 31^st, 2022, making most of the same corrections marked in today’s ‘Update A’.

NOTE 2: Mitsubishi updated another advisory today. If NCCIC-ICS does not address this Thursday, I will cover it this weekend.