New Mitsubishi Electric factory automation vulnerabilities identified

SecurityWeek reports that numerous Mitsubishi Electric factory automation products were disclosed to have been affected by serious security vulnerabilities, including a critical remote code execution flaw, tracked as CVE-2023-6943, and a high-severity authentication bypass vulnerability, tracked as CVE-2023-6942. Attackers could leverage the flaws to facilitate data exposure, tampering, and deletion, as well as denial-of-service, according to Mitsubishi Electric, which has recommended the immediate strengthening of cybersecurity measures amid the pending release of patches. Both vulnerabilities could also be exploited online and potentially compromise engineering workstations, noted Dragos vulnerability analyst Reid Wightman, who discovered and reported the flaws. "If an attacker targets these systems, they will gain high-privileged access to an engineering workstation. This means the attacker can likely communicate with and reprogram PLCs, as well as install new utilities on the engineering workstation," Wightman said. Industrial organizations have already been notified by the Cybersecurity and Infrastructure Security Agency regarding the bugs.