The U.S. Cybersecurity and Infrastructure Security Agency (CISA) this week released an Industrial Control Systems (ICS) advisory warning of multiple vulnerabilities in Mitsubishi Electric GX Works3 engineering software.
“Successful exploitation of these vulnerabilities could allow unauthorized users to gain access to the MELSEC iQ-R/F/L series CPU modules and the MELSEC iQ-R series OPC UA server module or to view and execute programs,” the agency said.
GX Works3 is an engineering workstation software used in ICS environments, acting as a mechanism for uploading and downloading programs from/to the controller, troubleshooting software and hardware issues, and performing maintenance operations.
The wide range of functions also makes the platform an attractive target for threat actors looking to compromise such systems to commandeer the managed PLCs.
Three of the 10 shortcomings relate to cleartext storage of sensitive data, four relate to the use of a hard-coded cryptographic key, two relate to the use of a hard-coded password, and one concerns a case of insufficiently protected credentials.
images from Hacker News