Mitsubishi Electric FA Engineering Software (Update C)

Risk Summary

Successful exploitation of these vulnerabilities could allow unauthorized users to gain access to the MELSEC iQ-R/F/L series CPU modules and the MELSEC iQ-R series OPC UA server module or to view and execute programs or view project files without permissions.

CVEs (10)

Remediations

• Mitsubishi Electric released and recommends users update to the latest version:
• GX Works3:
• CVE-2022-25164, CVE-2022-29830, and CVE-2022-29831: Download fixed Ver. 1.096A or later. Then set security version for project to "2".
• MX OPC UA Module Configurator-R:
• CVE-2022-25164: Download fixed Ver. 1.09K or later. Update the firmware version of the OPC UA server module to 10 or later.
• GT Designer3 Version1 (GOT2000):
• Motion Control Setting:
• For all other listed vulnerabilities, Mitsubishi Electric released mitigations/workarounds for users to follow:
• Ensure malicious actors cannot access project files, configuration files, security keys stored on the host machine via untrusted networks or hosts.
• Install antivirus software on the host machine running the software.
• Encrypt project files and security keys when sending or receiving over the Internet.
• Use the "authentication with a certificate" function instead of "username / password authentication" for user authentication for access from OPC UA clients to MELSEC iQ-R series OPC UA server modules (MX OPC UA Module Configurator-R only).
• For specific update instructions and additional details, see the Mitsubishi Electric advisory.
• CVE-2022-29826: Download fixed Ver. 1.090U or later
• CVE-2022-29826 and CVE-2022-29829: Download fixed Ver. 1.045X or later. Apply CVE-2022-29826 or CVE-2022-29829 mitigations for GX Works3 as well.
• CVE-2022-29825 and CVE-2022-29829: Download fixed Ver. 1.095Z or later. Then set security key's secure mode to Enabled.
• CVE-2022-29825 and CVE-2022-29829: Download fixed Ver. 1.295H or later. Then set security key's secure mode to Enabled.
• MT Works2:
• CVE-2022-29825 and CVE-2022-29829: Download fixed Ver. 1.205P or later and update the software. Then set security key's secure mode to Enabled.Please refer "MT Developer2 Help" – "Security Function" – "Manage Security Key" for details.
• CVE-2022-29830: Download fixed Ver. 1.070Y or later and update the software. Set security version for project to "2". Refer "Motion Control Setting Function Help" – "12.5. Preventing Illegal Access to/Falsification of Data (Security Version)" for details. Apply the countermeasure for CVE-2022-29830 listed in GX Works3.

Affected Vendors

Affected Products (13)

Affected Sectors

Critical Manufacturing