ICSA-21-049-02

icsaUScisa_csaf_ot

Mitsubishi Electric FA Engineering Software Products (Update H)

view advisory published 2021-02-18

Successful exploitation of these vulnerabilities may cause a denial-of-service condition.

01

describes (2)

Related CVEs.

IDseverity exploitable
CVE-2021-20588UScritical9.8—
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, C…
CVE-2021-20587UScritical9.8—
Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions 1…
02

references

External citations — patches, advisories, analysis.

03

remediations (152)

  • MitigationCPU Module Logging Configuration Tool

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationCPU Module Logging Configuration Tool

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationCW Configurator

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationCW Configurator

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationData Transfer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationData Transfer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationEZSocket

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationEZSocket

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationFR Configurator

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationFR Configurator

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationFR Configurator SW3

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationFR Configurator SW3

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationFR Configurator2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationFR Configurator2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGT Designer3 Version1(GOT1000)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGT Designer3 Version1(GOT1000)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGT Designer3 Version1(GOT2000)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGT Designer3 Version1(GOT2000)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGT SoftGOT1000 Version3

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGT SoftGOT1000 Version3

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGT SoftGOT2000 Version1

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGT SoftGOT2000 Version1

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Configurator-DP

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Configurator-DP

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Configurator-QP

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Configurator-QP

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Developer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Developer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Explorer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Explorer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX IEC Developer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX IEC Developer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX LogViewer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX LogViewer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX RemoteService-I

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX RemoteService-I

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Works2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Works2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Works3

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationGX Works3

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMELFA-Works

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMELFA-Works

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMELSEC WinCPU Setting Utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMELSEC WinCPU Setting Utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMELSOFT EM Software Development Kit (EM Configurator)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMELSOFT EM Software Development Kit (EM Configurator)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMELSOFT Navigator

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMELSOFT Navigator

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMH11 SettingTool Version2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMH11 SettingTool Version2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMI Configurator

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMI Configurator

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMT Works2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMT Works2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMX Component

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationMX Component

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationM_CommDTM-HART

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationM_CommDTM-HART

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationM_CommDTM-IO-Link

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationM_CommDTM-IO-Link

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationNetwork Interface Board CC IE Control utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationNetwork Interface Board CC IE Control utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationNetwork Interface Board CC IE Field Utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationNetwork Interface Board CC IE Field Utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationNetwork Interface Board CC-Link Ver.2 Utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationNetwork Interface Board CC-Link Ver.2 Utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationNetwork Interface Board MNETH utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationNetwork Interface Board MNETH utility

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationPX Developer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationPX Developer

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationRT ToolBox2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationRT ToolBox2

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationRT ToolBox3

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationRT ToolBox3

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationSLMP Data Collector

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationSLMP Data Collector

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationSetting/monitoring tools for the C Controller module (SW4PVC-CCPU)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationSetting/monitoring tools for the C Controller module (SW4PVC-CCPU)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationiQ Monozukuri ANDON (Data Transfer)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationiQ Monozukuri ANDON (Data Transfer)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationiQ Monozukuri Process Remote Monitoring (Data Transfer)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • MitigationiQ Monozukuri Process Remote Monitoring (Data Transfer)

    For users of products that do not have a fixed version or who cannot immediately update the product, Mitsubishi Electric recommends taking the following mitigations to minimize the risk of exploiting these vulnerabilities:

  • FixedCPU Module Logging Configuration Tool

    CPU Module Logging Configuration Tool: Version 1.118X or later

  • FixedCPU Module Logging Configuration Tool

    CPU Module Logging Configuration Tool: Version 1.118X or later

  • FixedCW Configurator

    CW Configurator: Version 1.012N or later

  • FixedCW Configurator

    CW Configurator: Version 1.012N or later

  • FixedData Transfer

    Data Transfer: Version 3.45X or later

  • FixedData Transfer

    Data Transfer: Version 3.45X or later

  • FixedEZSocket

    EZSocket: Version 5.5 or later

  • FixedEZSocket

    EZSocket: Version 5.5 or later

  • FixedFR Configurator

    FR Configurator

  • FixedFR Configurator

    FR Configurator

  • FixedFR Configurator SW3

    FR Configurator SW3

  • FixedFR Configurator SW3

    FR Configurator SW3

  • FixedFR Configurator2

    FR Configurator2: Version 1.25B or later

  • FixedFR Configurator2

    FR Configurator2: Version 1.25B or later

  • FixedGT SoftGOT1000 Version3

    GT SoftGOT1000 Version3: Version 3.255R or later

  • FixedGT SoftGOT1000 Version3

    GT SoftGOT1000 Version3: Version 3.255R or later

  • FixedGT SoftGOT2000 Version1

    GT SoftGOT2000 Version1: Version 1.255R or later

  • FixedGT SoftGOT2000 Version1

    GT SoftGOT2000 Version1: Version 1.255R or later

  • FixedGX Configurator-DP

    GX Configurator-DP: Version 7.15R or later

  • FixedGX Configurator-DP

    GX Configurator-DP: Version 7.15R or later

  • FixedGX Configurator-QP

    GX Configurator-QP

  • FixedGX Configurator-QP

    GX Configurator-QP

  • FixedGX Developer

    GX Developer: Version 8.507D or later

  • FixedGX Developer

    GX Developer: Version 8.507D or later

  • FixedGX Explorer

    GX Explorer

  • FixedGX Explorer

    GX Explorer

  • FixedGX IEC Developer

    GX IEC Developer

  • FixedGX IEC Developer

    GX IEC Developer

  • FixedGX LogViewer

    GX LogViewer: Version 1.118X or later

  • FixedGX LogViewer

    GX LogViewer: Version 1.118X or later

  • FixedGX RemoteService-I

    GX RemoteService-I

  • FixedGX RemoteService-I

    GX RemoteService-I

  • FixedGX Works2

    GX Works2: Version 1.600A or later

  • FixedGX Works2

    GX Works2: Version 1.600A or later

  • FixedGX Works3

    GX Works3: Version 1.072A or later

  • FixedGX Works3

    GX Works3: Version 1.072A or later

  • FixedMELFA-Works

    MELFA-Works: Version 4.5 or later

  • FixedMELFA-Works

    MELFA-Works: Version 4.5 or later

  • FixedMELSEC WinCPU Setting Utility

    MELSEC WinCPU Setting Utility

  • FixedMELSEC WinCPU Setting Utility

    MELSEC WinCPU Setting Utility

  • FixedMELSOFT Navigator

    MELSOFT Navigator: Version 2.78G or later

  • FixedMELSOFT Navigator

    MELSOFT Navigator: Version 2.78G or later

  • FixedMH11 SettingTool Version2

    MH11 SettingTool Version2: Version 2.005F or later

  • FixedMH11 SettingTool Version2

    MH11 SettingTool Version2: Version 2.005F or later

  • FixedMI Configurator

    MI Configurator: Version 1.005F or later

  • FixedMI Configurator

    MI Configurator: Version 1.005F or later

  • FixedMT Works2

    MT Works2: Version 1.170C or later

  • FixedMT Works2

    MT Works2: Version 1.170C or later

  • FixedMX Component

    MX Component: Version 5.002C or later

  • FixedMX Component

    MX Component: Version 5.002C or later

  • FixedM_CommDTM-HART

    M_CommDTM-HART

  • FixedM_CommDTM-HART

    M_CommDTM-HART

  • FixedM_CommDTM-IO-Link

    M_CommDTM-IO-Link: Version 1.04E or later

  • FixedM_CommDTM-IO-Link

    M_CommDTM-IO-Link: Version 1.04E or later

  • FixedNetwork Interface Board CC IE Control utility

    Network Interface Board CC IE Control utility: Version 1.30G or later

  • FixedNetwork Interface Board CC IE Control utility

    Network Interface Board CC IE Control utility: Version 1.30G or later

  • FixedNetwork Interface Board CC IE Field Utility

    Network Interface Board CC IE Field Utility: Version 1.17T or later

  • FixedNetwork Interface Board CC IE Field Utility

    Network Interface Board CC IE Field Utility: Version 1.17T or later

  • FixedNetwork Interface Board CC-Link Ver.2 Utility

    Network Interface Board CC-Link Ver.2 Utility: Version 1.24A or later

  • FixedNetwork Interface Board CC-Link Ver.2 Utility

    Network Interface Board CC-Link Ver.2 Utility: Version 1.24A or later

  • FixedNetwork Interface Board MNETH utility

    Network Interface Board MNETH utility: Version 35M or later

  • FixedNetwork Interface Board MNETH utility

    Network Interface Board MNETH utility: Version 35M or later

  • FixedPX Developer

    PX Developer: Version 1.54G or later

  • FixedPX Developer

    PX Developer: Version 1.54G or later

  • FixedRT ToolBox2

    RT ToolBox2: Version 3.74C or later

  • FixedRT ToolBox2

    RT ToolBox2: Version 3.74C or later

  • FixedRT ToolBox3

    RT ToolBox3: Version 1.90U or later

  • FixedRT ToolBox3

    RT ToolBox3: Version 1.90U or later

  • FixedSLMP Data Collector

    SLMP Data Collector: Version 1.05F or later

  • FixedSLMP Data Collector

    SLMP Data Collector: Version 1.05F or later

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan