ICS Advisory: Mitsubishi Electric FA Engineering Software Products

Summary:

A report issued by CISA (Cybersecurity and Infrastructure Security Agency) reveals a critical vulnerability in Mitsubishi Electric's FA Engineering Software Products, assigned a CVSS v3 score of 9.8. The vulnerabilities, missing authentication for critical function and unsafe reflection, allow an attacker to remotely exploit the products, potentially leading to unauthorized access, information disclosure, tampering, destruction, or deletion. The affected products include EZSocket, FR Configurator2, GT Designer3, GX Works2, MELSOFT Navigator, MT Works2, MX Component, and MX OPC Server DA/UA.

Mitigation measures recommended by Mitsubishi Electric include using firewalls, VPNs, and restricting physical access to computers and networks. CISA advises organizations to perform proper impact analysis and risk assessment before deploying defensive measures and encourages implementing recommended cybersecurity strategies for proactive defense.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.