Mitsubishi Electric MELSEC Series CPU module (Update D)

Risk Summary

Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service condition or execute malicious programs on a target product by sending specially crafted packets.

CVEs (1)

Remediations

• Mitsubishi Electric created the following firmware versions to address this issue and encourages users to update:
• MELSEC iQ-F Series: firmware version 1.290.
• MELSEC iQ-R Series R00CPU: firmware version 36 or later.
• MELSEC iQ-R Series R01CPU: firmware version 36 or later.
• MELSEC iQ-R Series R02CPU: firmware version 36 or later.
• MELSEC iQ-R Series R04(EN)CPU: firmware version 69 or later.
• MELSEC iQ-R Series R08(EN)CPU: firmware version 69 or later.
• MELSEC iQ-R Series R16(EN)CPU: firmware version 69 or later.
• MELSEC iQ-R Series R32(EN)CPU: firmware version 69 or later.
• MELSEC iQ-R Series R120(EN)CPU: firmware version 69 or later.
• MELSEC iQ-R Series R08SFCPU: firmware version 32 or later.
• MELSEC iQ-R Series R16SFCPU: firmware version 32 or later.
• MELSEC iQ-R Series R32SFCPU: firmware version 32 or later.
• MELSEC iQ-R Series R120SFCPU: firmware version 32 or later.
• MELSEC iQ-R Series R08PCPU: firmware version 38 or later.
• MELSEC iQ-R Series R16PCPU: firmware version 38 or later.
• MELSEC iQ-R Series R32PCPU: firmware version 38 or later.
• MELSEC iQ-R Series R120PCPU: firmware version 38 or later.
• In case of using the affected MELSEC iQ-R Series R08/16/32/120SFCPU, take mitigations and workarounds measures because updating the product to the fixed version is not available.
• Users should refer to the following manuals when updating: (1) "9 FIRMWARE UPDATE FUNCTION" in the MELSEC iQ-F FX5 User's Manual (Application) and (2) MELSEC iQ-R Module Configuration Manual "Appendix 2: Firmware Update Function."
• Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:
• Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.
• Use within a LAN and block access from untrusted networks and hosts through firewalls.
• Restrict physical access to the LAN that is connected by affected products.
• Use IP filter function to block access from untrusted hosts. For details regarding the IP filter function, users can refer to: "13.1 IP Filter Function" in the MELSEC iQ-F FX5 User's Manual (Communication). "1.13 Security"-"IP filter" in the MELSEC iQ-R Ethernet User's Manual (Application).
• "13.1 IP Filter Function" in the MELSEC iQ-F FX5 User's Manual (Communication).
• "1.13 Security"-"IP filter" in the MELSEC iQ-R Ethernet User's Manual (Application).
• For specific update instructions and additional details see the Mitsubishi Electric advisory.

Affected Vendors

Affected Products (43)

Affected Sectors

Critical Manufacturing