www.cisa.gov Open in urlscan Pro
2600:141b:13:78c::447a  Public Scan

Form analysis
2 forms found in the DOM

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id1">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
  <table cellspacing="0" cellpadding="0" role="presentation" class="gsc-search-box">
    <tbody>
      <tr>
        <td class="gsc-input">
          <div class="gsc-input-box" id="gsc-iw-id2">
            <table cellspacing="0" cellpadding="0" role="presentation" id="gs_id51" class="gstl_51 gsc-input" style="width: 100%; padding: 0px;">
              <tbody>
                <tr>
                  <td id="gs_tti51" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" aria-label="search" id="gsc-i-id2" dir="ltr" spellcheck="false"
                      style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; outline: none;"></td>
                  <td class="gsib_b">
                    <div class="gsst_b" id="gs_st51" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb51" aria-hidden="true">×</span></a></div>
                  </td>
                </tr>
              </tbody>
            </table>
          </div>
        </td>
        <td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
              <title>search</title>
              <path
                d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
              </path>
            </svg></button></td>
        <td class="gsc-clear-button">
          <div class="gsc-clear-button" title="clear results">&nbsp;</div>
        </td>
      </tr>
    </tbody>
  </table>
</form>

Text Content

Skip to main content

An official website of the United States government

Here’s how you know

Here’s how you know

Official websites use .gov
A .gov website belongs to an official government organization in the United
States.

Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the
.gov website. Share sensitive information only on official, secure websites.


Cybersecurity & Infrastructure Security Agency
America's Cyber Defense Agency

Search

×

search
 

Menu
Close
×

search
 

 * Topics
   Topics
   Cybersecurity Best Practices
   Cyber Threats and Advisories
   Critical Infrastructure Security and Resilience
   Election Security
   Emergency Communications
   Industrial Control Systems
   Information and Communications Technology Supply Chain Security
   Partnerships and Collaboration
   Physical Security
   Risk Management
   How can we help?
   GovernmentEducational InstitutionsIndustryState, Local, Tribal, and
   TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help
   Locally
 * Spotlight
 * Resources & Tools
   Resources & Tools
   All Resources & Tools
   Services
   Programs
   Resources
   Training
   Groups
 * News & Events
   News & Events
   News
   Events
   Cybersecurity Alerts & Advisories
   Directives
   Request a CISA Speaker
   Congressional Testimony
 * Careers
   Careers
   Benefits & Perks
   HireVue Applicant Reasonable Accommodations Process
   Hiring
   Resume & Application Tips
   Students & Recent Graduates
   Veteran and Military Spouses
   Work @ CISA
 * About
   About
   Culture
   Divisions & Offices
   Regions
   Leadership
   Doing Business with CISA
   Contact Us
   Site Links
   Reporting Employee and Contractor Misconduct
   CISA GitHub

Report a Cyber Issue
America's Cyber Defense Agency
Breadcrumb
 1. Home
 2. News & Events
 3. Cybersecurity Advisories
 4. ICS Advisory

Share:


ICS Advisory


MITSUBISHI ELECTRIC FA PRODUCTS (UPDATE A)

Last Revised
June 01, 2022
Alert Code
ICSA-22-090-04



1. EXECUTIVE SUMMARY

 * CVSS v3 7.4
 * ATTENTION: Exploitable remotely
 * Vendor: Mitsubishi Electric
 * Equipment: FA products
 * Vulnerabilities: Use of Password Hash Instead of Password for Authentication,
   Use of Weak Hash, Cleartext Storage of Sensitive Information, Authentication
   Bypass by Capture-replay


2. UPDATE INFORMATION

This updated advisory is a follow-up to the original advisory titled
ICSA-22-090-04 Mitsubishi Electric FA Products that was published March 31,
2022, on the ICS webpage on cisa.gov/ics.


3. RISK EVALUATION

Successful exploitation of these vulnerabilities may allow an attacker to log in
to the affected products and/or alter and obtain sensitive information.


4. TECHNICAL DETAILS


4.1 AFFECTED PRODUCTS

The following FA products are affected:

 * MELSEC iQ-F Series FX5U(C) CPU modules, All models: All versions
 * MELSEC iQ-F Series FX5UJ CPU modules, All models: All versions

--------- Begin Update A Part 1 of 2 ---------

 * MELSEC iQ-R series: All Versions of the following:
   * R00/01/02CPU:
   * R04/08/16/32/120(EN)CPU
   * R08/16/32/120SFCPU
   * R08/16/32/120PCPU
   * R08/16/32/120PSFCPU
   * R16/32/64MTCPU
   * RJ71GN11-T2
   * RJ71GN11-EIP
   * RJ71C24(-R2/R4)
   * RJ71EN71
   * RJ71GF11-T2
   * RJ71GP21(S)-SX
   * RJ72GF15-T2
 * MELSEC Q series: All Versions of the following: 
   * Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU
   * Q03/04/06/13/26UDVCPU
   * Q04/06/13/26UDPVCPU
   * QJ71C24N(-R2/R4)
   * QJ71E71-100
   * QJ72BR15
   * QJ72LP25(-25/G/GE)
 * MELSEC L series: All Versions of the following:
   * L02/06/26CPU(-P), L26CPU-(P)BT
   * LJ71C24(-R2)
   * LJ71E71-100
   * LJ72GF15-T2

--------- End Update A Part 1 of 2 ---------


4.2 VULNERABILITY OVERVIEW

4.2.1    USE OF PASSWORD HASH INSTEAD OF PASSWORD FOR AUTHENTICATION
CWE-836(LINK IS EXTERNAL)

This vulnerability  allows a remote unauthenticated attacker to log in to the
product by replaying an eavesdropped password hash.

CVE-2022-25155 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been assigned; the CVSS vector string is
(AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N(link is external)).

4.2.2    USE OF WEAK HASH CWE-328(LINK IS EXTERNAL)

This vulnerability could allow a remote unauthenticated attacker to log in to
the product by using a password reversed from an eavesdropped password hash.

CVE-2022-25156 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been assigned; the CVSS vector string is
(AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N(link is external)).

4.2.3    USE OF PASSWORD HASH INSTEAD OF PASSWORD FOR AUTHENTICATION
CWE-836(LINK IS EXTERNAL)

This vulnerability could allow a remote unauthenticated attacker to disclose or
tamper with the information in the product by using an eavesdropped password
hash.

CVE-2022-25157 has been assigned to this vulnerability. A CVSS v3 base score of
7.4 has been assigned; the CVSS vector string is
(AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N(link is external)).

4.2.4    CLEARTEXT STORAGE OF SENSITIVE INFORMATION CWE-312(LINK IS EXTERNAL)

This vulnerability could allow a remote attacker to disclose or tamper with a
file where the password hash is saved in cleartext.

CVE-2022-25158 has been assigned to this vulnerability. A CVSS v3 base score of
7.4 has been assigned; the CVSS vector string is
(AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N(link is external)).

4.2.5    AUTHENTICATION BYPASS BY CAPTURE-REPLAY CWE-294(LINK IS EXTERNAL)

This vulnerability could allow a remote unauthenticated attacker to log in to
the product by replay attack.

CVE-2022-25159 has been assigned to this vulnerability. A CVSS v3 base score of
5.9 has been assigned; the CVSS vector string is
(AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N(link is external)).

4.2.6     CLEARTEXT STORAGE OF SENSITIVE INFORMATION CWE-312(LINK IS EXTERNAL)

This vulnerability could allow a remote unauthenticated attacker to disclose a
file in a legitimate user's product by using previously eavesdropped cleartext
information and to counterfeit a legitimate user’s system.

CVE-2022-25160 has been assigned to this vulnerability. A CVSS v3 base score of
6.8 has been assigned; the CVSS vector string is
(AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N(link is external)).


4.3 BACKGROUND

 * CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
 * COUNTRIES/AREAS DEPLOYED: Worldwide
 * COMPANY HEADQUARTERS LOCATION: Japan


4.4 RESEARCHER

Anton Dorfman, Dmitry Sklyarov, Iliya Rogachev and Artur Akhatov of Positive
Technologies reported these vulnerabilities to Mitsubishi Electric.


5. MITIGATIONS

Mitsubishi Electric recommends users take the following mitigation measures to
minimize the risk of exploitation of these vulnerabilities:

 * When communicating via untrusted networks or hosts, encrypt the communication
   path by setting up a VPN.

--------- Begin Update A Part 2 of 2 ---------

 * Use firewalls or IP filter function to restrict connections to the products
   and prevent access from untrusted networks or hosts. For details on IP filter
   function, refer to the following product manual: 
   * “12.1 IP Filter Function” in the MELSEC iQ-F FX 5 User’s Manual (Ethernet
     Communication)
   * "IP filter" of "1.13 Security" in the MELSEC iQ-R Ethernet User's Manual
     (Application)
   * "IP Filter Function" of "6.2 Security Function" in the MELSEC iQ-R Motion
     Controller Programming Manual (Common)
   * "IP filter" of "1.4 Security" in the MELSEC iQ-R CC-Link IE TSN User's
     Manual (Application)
   * "IP filter" of "9.5 Security" in the MELSEC iQ-R CC-Link IE TSN Plus
     Master/Local Module User’s Manual
   * "14.3 IP Filter Function" in the Q Corresponding Ethernet Interface Module
     User's Manual (Basic)
   * "14.3 IP Filter Function" in the MELSEC-L Ethernet Interface Module User's
     Manual (Basic)

--------- End Update A Part 2 of 2 ---------

For more information see Mitsubishi Electric’s advisory 2021-031(link is
external)

CISA reminds organizations to perform proper impact analysis and risk assessment
prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices
on the ICS webpage on cisa.gov/ics Several recommended practices are available
for reading and download, including Improving Industrial Control Systems
Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage on cisa.gov/ics in the Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies.

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to CISA for tracking
and correlation against other incidents.

No known public exploits specifically target these vulnerabilities. These
vulnerabilities have a high attack complexity.


VENDOR

Mitsubishi Electric


PLEASE SHARE YOUR THOUGHTS

We recently updated our anonymous product survey; we’d welcome your feedback.


RELATED ADVISORIES

May 25, 2023
ICS Advisory | ICSA-23-145-01


MOXA MXSECURITY SERIES

May 23, 2023
ICS Advisory | ICSA-23-143-03


MITSUBISHI ELECTRIC MELSEC SERIES CPU MODULE

May 23, 2023
ICS Advisory | ICSA-23-143-01


HITACHI ENERGY’S AFS65X, AFS67X, AFR67X AND AFF66X PRODUCTS

May 23, 2023
ICS Advisory | ICSA-23-143-04


HORNER AUTOMATION CSCAPE

Return to top
 * Topics
 * Spotlight
 * Resources & Tools
 * News & Events
 * Careers
 * About

Cybersecurity & Infrastructure Security Agency
 * Facebook
 * Twitter
 * LinkedIn
 * YouTube
 * Instagram
 * RSS

CISA Central 888-282-0870 Central@cisa.dhs.gov(link sends email)
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
 * About CISA
 * Accessibility
 * Budget and Performance
 * DHS.gov
 * FOIA Requests
 * No FEAR Act
 * Office of Inspector General
 * Privacy Policy
 * Subscribe
 * The White House
 * USA.gov
 * Website Feedback