Multiple vulnerabilities in JTEKT TOYOPUC Products

Published: 2022-06-22

Risk	High
Patch available	NO
Number of vulnerabilities	2
CVE-ID	CVE-2022-29951 CVE-2022-29958
CWE-ID	CWE-306 CWE-345
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	TOYOPUC PC10G-CPU TCC-6353 Hardware solutions / Firmware TOYOPUC PC10GE TCC-6464 Hardware solutions / Firmware TOYOPUC PC10P TCC-6372 Hardware solutions / Firmware TOYOPUC PC10P-DP TCC-6726 Hardware solutions / Firmware TOYOPUC PC10P-DP-IO TCC-6752 Hardware solutions / Firmware TOYOPUC PC10B-P TCC-6373 Hardware solutions / Firmware TOYOPUC PC10B TCC-1021 Hardware solutions / Firmware TOYOPUC PC10E TCC-4737 Hardware solutions / Firmware TOYOPUC PC10EL TCC-4747 Hardware solutions / Firmware TOYOPUC Plus CPU TCC-6740 Hardware solutions / Firmware TOYOPUC PC3JX TCC-6901 Hardware solutions / Firmware TOYOPUC PC3JX-D TCC-6902 Hardware solutions / Firmware TOYOPUC PC10PE TCC-1101 Hardware solutions / Firmware TOYOPUC PC10PE-1616P TCC-1102 Hardware solutions / Firmware TOYOPUC PCDL TKC-6688 Hardware solutions / Firmware TOYOPUC Nano 10GX TUC-1157 Hardware solutions / Firmware TOYOPUC Nano CPU TUC-6941 Hardware solutions / Firmware
Vendor	JTEKT Corporation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authentication for Critical Function

EUVDB-ID: #VU64580

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-29951

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected product lacks authentication functionality. A remote attacker can change controller configurations, manipulate data or cause a denial of service (DoS) condition.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

TOYOPUC PC10G-CPU TCC-6353: All versions

TOYOPUC PC10GE TCC-6464: All versions

TOYOPUC PC10P TCC-6372: All versions

TOYOPUC PC10P-DP TCC-6726: All versions

TOYOPUC PC10P-DP-IO TCC-6752: All versions

TOYOPUC PC10B-P TCC-6373: All versions

TOYOPUC PC10B TCC-1021: All versions

TOYOPUC PC10E TCC-4737: All versions

TOYOPUC PC10EL TCC-4747: All versions

TOYOPUC Plus CPU TCC-6740: All versions

TOYOPUC PC3JX TCC-6901: All versions

TOYOPUC PC3JX-D TCC-6902: All versions

TOYOPUC PC10PE TCC-1101: All versions

TOYOPUC PC10PE-1616P TCC-1102: All versions

TOYOPUC PCDL TKC-6688: All versions

TOYOPUC Nano 10GX TUC-1157: All versions

TOYOPUC Nano CPU TUC-6941: All versions

External links

http://ics-cert.us-cert.gov/advisories/icsa-22-172-02

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Insufficient verification of data authenticity

EUVDB-ID: #VU64582