Mitsubishi Electric FA Products

🗓️ 31 Mar 2022 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 58 Views

Mitsubishi Electric FA Products (Update A) vulnerability advisory for multiple products including MELSEC iQ-F, iQ-R, Q, and L serie

Reporter	Title	Published	Views	Family All 74
ATTACKERKB	CVE-2022-25158	1 Apr 202223:15	–	attackerkb
ATTACKERKB	CVE-2022-25157	1 Apr 202223:15	–	attackerkb
ATTACKERKB	CVE-2022-25156	1 Apr 202223:15	–	attackerkb
ATTACKERKB	CVE-2022-25160	1 Apr 202223:15	–	attackerkb
ATTACKERKB	CVE-2022-25155	1 Apr 202223:15	–	attackerkb
ATTACKERKB	CVE-2022-25159	1 Apr 202223:15	–	attackerkb
BDU FSTEC	The vulnerability of the microprogrammed software of the MELSEC iQ-F Series FX5U and MELSEC iQ-F Series FX5UJ programmable logic controllers lies in the use of a reversible one-way hash function. This function allows an intruder to gain unauthorized access to protected information.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the microprogrammed software of the MELSEC iQ-F Series FX5U and MELSEC iQ-F Series FX5UJ programmable logic controllers lies in the use of a password hash instead of a plain text password for authentication. This allows attackers to disclose sensitive information or compromise data integrity.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the microprogrammed software of the MELSEC iQ-F Series FX5U and MELSEC iQ-F Series FX5UJ programmable logic controllers, related to the unencrypted storage of user data, allows a intruder to gain increased privileges.	13 Apr 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the microprogrammed software of the MELSEC iQ-F Series FX5U and MELSEC iQ-F Series FX5UJ programmable logic controllers lies in the unencrypted storage of user data, allowing an intruder to gain unauthorized access to the protected information.	13 Apr 202200:00	–	bdu_fstec

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-090-04.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-22-090-04
cisa	www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

31 Mar 2022 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 26.8

CVSS 3.19.1

EPSS0.00739

cvss v3 7.4 exploitable remotely use of password hash instead of password for authentication use of weak hash cleartext storage of sensitive information authentication bypass by capture-replay disclosure of sensitive information altering sensitive information melsec iq-f series melsec iq-r series melsec q series melsec l series cve-2022-25155 cve-2022-25156 cve-2022-25157 cve-2022-25158 icsa-22-090-04 ics cisa.gov