CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-24-058-01: Mitsubishi Electric Multiple Factory Automation Products (Update A) ↗ source

February 27, 2024 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-058-01

Summary

Successful exploitation of this vulnerability could allow a remote attacker to cause a temporary denial-of-service (DoS) condition for a certain period of time in the product's Ethernet communication by performing a TCP SYN Flood attack. CVE-2023-7033: In Mitsubishi Electric multiple FA products there is a denial-of-service (DoS) vulnerability that exists in the Ethernet function. A remote attacker could cause a temporary denial-of-service (DoS) condition for a certain period of time in the product's Ethernet communication by performing a TCP SYN Flood attack.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-24-058-01
Status
Final · version 2
Initial release
2024-02-27
Last revised
2025-01-16 (2 revisions)
Vendor
Mitsubishi Electric Corporation
Critical infrastructure sectors
Critical Manufacturing
Deployed
Worldwide
Vendor headquarters
Japan

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: Mitsubishi Electric Corporation

Affected products (159)
  • MELSEC iQ-R series CPU module R00CPU — all versions
  • MELSEC iQ-R series CPU module R01CPU — all versions
  • MELSEC iQ-R series CPU module R02CPU — all versions
  • MELSEC iQ-R series CPU module R04 (EN)CPU — all versions
  • MELSEC iQ-R series CPU module R08 (EN)CPU — all versions
  • MELSEC iQ-R series CPU module R16 (EN)CPU — all versions
  • MELSEC iQ-R series CPU module R32(EN)CPU — all versions
  • MELSEC iQ-R series CPU module R120(EN)CPU — all versions
  • MELSEC iQ-R series CPU module R08SFCPU — all versions
  • MELSEC iQ-R series CPU module R16SFCPU — all versions
  • MELSEC iQ-R series CPU module R32SFCPU — all versions
  • MELSEC iQ-R series CPU module R120SFCPU — all versions
  • MELSEC iQ-R series CPU module R08PCPU — all versions
  • MELSEC iQ-R series CPU module R16PCPU — all versions
  • MELSEC iQ-R series CPU module R32PCPU — all versions
  • MELSEC iQ-R series CPU module R120PCPU — all versions
  • MELSEC iQ-R series CPU module R08PSFCPU — all versions
  • MELSEC iQ-R series CPU module R16PSFCPU — all versions
  • MELSEC iQ-R series CPU module R32PSFCPU — all versions
  • MELSEC iQ-R series CPU module R120PSFCPU — all versions
  • MELSEC iQ-L series CPU module L04HCPU(sold in limited regions) — all versions
  • MELSEC iQ-L series CPU module L08HCPU(sold in limited regions) — all versions
  • MELSEC iQ-L series CPU module L16HCPU(sold in limited regions) — all versions
  • MELSEC iQ-L series CPU module L32HCPU(sold in limited regions) — all versions
  • MELSEC iQ-R Ethernet Interface Module RJ71EN71 — all versions
  • MELSEC iQ-R CC-Link IE TSN Master/Local Module RJ71GN11-T2 — all versions
  • MELSEC iQ-R CC-Link IE TSN Master/Local Module RJ71GN11-SX — all versions
  • MELSEC iQ-R CC-Link IE TSN Master/Local Module RJ71GN11-EIP — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2B1-32D — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2B1-32T — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2B1-32TE — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2B1-32DT — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2B1-32DTE — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2B1-16D — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2B1-16T — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2B1-16TE — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2S1-32D — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2S1-32T — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2S1-32TE — all versions
  • CC-Link IE TSN Remote I/O Module NZ2GN2S1-32DT — all versions
  • … and 119 more in the source document
Revision history (2)
  • 2025-01-16 — v2: Update A - Added detail to affected product and mitigation sections.
  • 2024-02-27 — v1: Initial Publication

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2023-7033 CWE-410 Insufficient Resource Pool 5.3 Medium In Mitsubishi Electric multiple FA products there is a denial-of-service (DoS) vulnerability that exists in the Ethernet function. A remote attacker could cause a temporary denial-of-service (DoS) condition for a certain period of time in the product's Ethernet communication by performing a TCP SYN Flood attack.

Mitigation: Mitsubishi Electric has no plans to release a fixed version, so they kindly ask users to address this issue through the following mitigation measures to minimize the risk of exploiting this vulnerability:

Mitigation: Use a firewall, virtual private network (VPN) etc., to prevent unauthorized access when Internet access is required.

Mitigation: Use within a LAN and block access from untrusted networks and hosts through firewalls.

Affected, fixed & timeline

Affected:

  • MELSEC iQ-R series CPU module R00CPU all versions
  • MELSEC iQ-R series CPU module R01CPU all versions
  • MELSEC iQ-R series CPU module R02CPU all versions
  • MELSEC iQ-R series CPU module R04 (EN)CPU all versions
  • MELSEC iQ-R series CPU module R08 (EN)CPU all versions
  • MELSEC iQ-R series CPU module R16 (EN)CPU all versions
  • MELSEC iQ-R series CPU module R32(EN)CPU all versions
  • MELSEC iQ-R series CPU module R120(EN)CPU all versions
  • MELSEC iQ-R series CPU module R08SFCPU all versions
  • MELSEC iQ-R series CPU module R16SFCPU all versions
  • MELSEC iQ-R series CPU module R32SFCPU all versions
  • MELSEC iQ-R series CPU module R120SFCPU all versions
  • MELSEC iQ-R series CPU module R08PCPU all versions
  • MELSEC iQ-R series CPU module R16PCPU all versions
  • MELSEC iQ-R series CPU module R32PCPU all versions
  • … and 144 more

Mitigation: Use IP filter function to block access from untrusted hosts.

Mitigation: Restrict physical access to the affected products and the LAN to which they are connected.

Mitigation: The IP filter function can be set on the following models. For details on the IP filter function, please refer to the following manual for each product:

Mitigation: "1.13 IP Filter" in the MELSEC iQ-R Ethernet User's Manual (Application)

Mitigation: MELSEC iQ-L CPU 模块用户手册(应用篇) 24.1 IP 滤波器功能

Mitigation: "1.4 Security/IP filter" in the MELSEC iQ-R Motion Module User's Manual (Network)

Mitigation: MELSEC iQ-L 运动模块用户手册(网络篇) 1.4 安全 IP 滤波器

Mitigation: "3.5 Security/IP filter" in the MELSEC iQ-F FX5 Motion Module User's Manual (CC-Link IE TSN)

Mitigation: "13.1 IP Filter Function" in the MELSEC iQ-F FX5 User's Manual (Communication)

Mitigation: "12.1 IP Filter Function" in the MELSEC iQ-F FX5 User's Manual (Ethernet Communication)

Mitigation: "4.4 IP Filter" in the MELSEC iQ-F FX5 OPC UA Module User's Manual

Mitigation: "4.5.1 IP Filter" in the MELSEC iQ-F FX5 OPC UA Module User's Manual

Mitigation: For specific update instructions and additional details refer to Mitsubishi Electric advisory 2023-023

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2023-7033 5.3 Medium Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R00CPU Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L series CP…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.