No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
Credit: Mitsubishi Electric
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2022-4450 | CWE-415 Double Free | 7.5 High |
The affected products contain a double free vulnerability when reading a PEM file. An attacker could cause denial-of-service (DoS) on the product by leading a legitimate user to importing a malicious certificate. Mitigation: Mitsbuishi Electric recommends that users update their products to the following versions: Mitigation: GT SoftGOT2000: Version 1.295H or later Mitigation: OPC UA data collector: 1.05F or later Affected, fixed & timelineAffected:
Mitigation: MX OPC Server UA: Use recommended mitigations/workarounds Mitigation: OPC UA server unit: Use recommended mitigations/workarounds Vendor fix: FX5-OPC: Version 1.010 or later Mitigation: Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Mitigation: GT SoftGOT2000 and OPC UA Data Collector: Do not load untrusted certificate revocation lists (CRLs). Mitigation: MX OPC Server UA: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Mitigation: OPC UA Server Unit: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Set a security policy other than 'None' … Vendor fix: FX5-OPC: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Use the IP filter function to block access from unt… Mitigation: For additional details, see the Mitsubishi Electric advisory 2023-018. |
| CVE-2023-0286 | CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') | 7.4 High |
The affected products contain a type confusion vulnerability relating to X.400 addressprocessing inside an X.509 GeneralName. An attacker could disclose sensitive information in memory of the product or cause denial-of-service (DoS) on the product by getting to load a specially crafted certificate revocation list (CRL). Mitigation: Mitsbuishi Electric recommends that users update their products to the following versions: Mitigation: GT SoftGOT2000: Version 1.295H or later Mitigation: OPC UA data collector: 1.05F or later Affected, fixed & timelineAffected:
Mitigation: MX OPC Server UA: Use recommended mitigations/workarounds Mitigation: OPC UA server unit: Use recommended mitigations/workarounds Mitigation: FX5-OPC: Version 1.010 or later Mitigation: Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Mitigation: GT SoftGOT2000 and OPC UA Data Collector: Do not load untrusted certificate revocation lists (CRLs). Mitigation: MX OPC Server UA: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Mitigation: OPC UA Server Unit: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Set a security policy other than 'None' … Mitigation: FX5-OPC: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Use the IP filter function to block access from unt… Mitigation: For additional details, see the Mitsubishi Electric advisory 2023-018. |
| CVE-2022-4304 | CWE-208 Observable Timing Discrepancy | 5.9 Medium |
The affected products contain an observable timing discrepancy vulnerability in their RSA decryption implementation. By sending specially crafted packets and performing a Bleichenbacher style attack, an attack method to decrypt ciphertext by observing the behavior when a padding error occurs, an attacker could decrypt the ciphertext and disclose sensitive information. Mitigation: Mitsbuishi Electric recommends that users update their products to the following versions: Mitigation: GT SoftGOT2000: Version 1.295H or later Mitigation: OPC UA data collector: 1.05F or later Affected, fixed & timelineAffected:
Mitigation: MX OPC Server UA: Use recommended mitigations/workarounds Mitigation: OPC UA server unit: Use recommended mitigations/workarounds Vendor fix: FX5-OPC: Version 1.010 or later Mitigation: Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk of exploiting these vulnerabilities: Mitigation: GT SoftGOT2000 and OPC UA Data Collector: Do not load untrusted certificate revocation lists (CRLs). Mitigation: MX OPC Server UA: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Vendor fix: OPC UA Server Unit: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Set a security policy other than 'None' … Vendor fix: FX5-OPC: Use within a LAN and block access from untrusted networks and hosts through firewalls. Restrict physical access to the product, as well as to computers and network devices located within the same network as the product. Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required. Use the IP filter function to block access from unt… Mitigation: For additional details, see the Mitsubishi Electric advisory 2023-018. |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2022-4450 | 7.5 High | OpenSSL OpenSSL The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload da… |
| CVE-2023-0286 | 7.4 High | OpenSSL OpenSSL There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRI… |
| CVE-2022-4304 | 5.9 Medium | OpenSSL OpenSSL A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in … |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.