ICS Advisory: Mitsubishi Electric Multiple Factory Automation Products

Summary

Mitsubishi Electric Corporation has identified a vulnerability in its MELSEC iQ-F Series products, affecting multiple versions of compact control platforms. The vulnerability, CVE-2023-7033, is exploitable remotely and has a CVSS v3.1 base score of 5.3. An attacker can cause a temporary denial-of-service (DoS) condition in the product's Ethernet communication by performing a TCP SYN Flood attack. The affected products are used in critical manufacturing and are deployed worldwide. The vendor recommends implementing mitigations such as configuring firewalls, using VPNs, and restricting physical access to the affected products and the LAN. CISA also provides additional guidance for minimizing the risk of exploitation and improving industrial control systems cybersecurity.