Multiple vulnerabilities in Mitsubishi Electric FA Products



Published: 2022-04-04 | Updated: 2022-06-02
Risk Medium
Patch available NO
Number of vulnerabilities 6
CVE-ID CVE-2022-25155
CVE-2022-25156
CVE-2022-25157
CVE-2022-25158
CVE-2022-25159
CVE-2022-25160
CWE-ID CWE-836
CWE-312
CWE-294
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		MELSEC iQ-F series FX5U(C) CPU module
Hardware solutions / Routers & switches, VoIP, GSM, etc

MELSEC iQ-F Series FX5UJ CPU module
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor Mitsubishi Electric

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Use of Password Hash Instead of Password for Authentication

EUVDB-ID: #VU61822

Risk: Medium

CVSSv3.1: 5.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-25155

CWE-ID: CWE-836 - Use of Password Hash Instead of Password for Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to use of password hash instead of password for authentication. A remote attacker can log in to the product by replaying an eavesdropped password hash.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

MELSEC iQ-F series FX5U(C) CPU module: All versions

MELSEC iQ-F Series FX5UJ CPU module: All versions

External links

http://jvn.jp/vu/JVNVU96577897/index.html
http://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
http://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04
http://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2021-08/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Reversible One-Way Hash

EUVDB-ID: #VU61823

Risk: Medium

CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-25156

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to use of weak hash. A remote attacker can log in to the product by using a password reversed from an eavesdropped password hash.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

MELSEC iQ-F series FX5U(C) CPU module: All versions

MELSEC iQ-F Series FX5UJ CPU module: All versions

External links

http://jvn.jp/vu/JVNVU96577897/index.html
http://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
http://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04
http://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2021-09/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use of Password Hash Instead of Password for Authentication

EUVDB-ID: #VU61824

Risk: Medium

CVSSv3.1: 6.8 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-25157

CWE-ID: CWE-836 - Use of Password Hash Instead of Password for Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to use of password hash instead of password for authentication. A remote attacker can disclose or tamper with the information in the product by using an eavesdropped password hash.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

MELSEC iQ-F series FX5U(C) CPU module: All versions

MELSEC iQ-F Series FX5UJ CPU module: All versions

External links

http://jvn.jp/vu/JVNVU96577897/index.html
http://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
http://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04
http://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2021-10/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cleartext storage of sensitive information

EUVDB-ID: #VU61825

Risk: Medium

CVSSv3.1: 6.8 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-25158

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the password hash is saved in cleartext. A remote attacker can disclose or tamper with a file.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

MELSEC iQ-F series FX5U(C) CPU module: All versions

MELSEC iQ-F Series FX5UJ CPU module: All versions

External links

http://jvn.jp/vu/JVNVU96577897/index.html
http://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
http://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04
http://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2021-11/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Authentication Bypass by Capture-replay

EUVDB-ID: #VU61826

Risk: Medium

CVSSv3.1: 5.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-25159

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker can log in to the product by replay attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MELSEC iQ-F series FX5U(C) CPU module: All versions

MELSEC iQ-F Series FX5UJ CPU module: All versions

External links

http://jvn.jp/vu/JVNVU96577897/index.html
http://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
http://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04
http://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2021-12/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cleartext storage of sensitive information

EUVDB-ID: #VU61827

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-25160

CWE-ID: CWE-312 - Cleartext Storage of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the password hash is saved in cleartext. A remote attacker can disclose a file in a legitimate user's product by using previously eavesdropped cleartext information and counterfeit a legitimate user’s system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

MELSEC iQ-F series FX5U(C) CPU module: All versions

MELSEC iQ-F Series FX5UJ CPU module: All versions

External links

http://jvn.jp/vu/JVNVU96577897/index.html
http://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-031_en.pdf
http://www.cisa.gov/uscert/ics/advisories/icsa-22-090-04
http://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2021-13/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###