Mitsubishi manufacturing controller software inherited OpenSSL bugs

By

CISA warns about remote code execution, DoS exploits.

Mitsubishi Electric industrial control software deployed on a global basis is vulnerable to critical OpenSSL vulnerabilities that were discovered earlier this year.

Mitsubishi manufacturing controller software inherited OpenSSL bugs

US Cyber Security and Infrastructure Security Agency (CISA) warns that the company’s GT SoftGOT2000 is used in critical manufacturing applications.

GT SoftGOT2000 emulates the company’s GOT controllers on PCs, offering control over everything from PLCs to industrial robots.

The software is vulnerable to the controversial CVE-2022-1292 command injection bug, which in June sparked arguments over whether or not it offered a remote code execution vector.

That question must have been resolved, since the CISA alert assigns a Common Vulnerabilities Scoring System score of 9.8 to the bug, making it critical.

The other OpenSSL vulnerability, CVE-2022-0778, is an infinite loop denial-of-service bug discovered by Google researcher Tavis Ormandy in February and 
patched in March.

Mitsubishi said (pdf) the bugs are fixed in GT SoftGOT2000 version 1.280S or later.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Actor auth tokens gave Global Admin access across Azure Entra ID tenants

Actor auth tokens gave Global Admin access across Azure Entra ID tenants

First npm worm "Shai-Hulud" released in supply chain attack

First npm worm "Shai-Hulud" released in supply chain attack

"VoidProxy" PhishKit targets Google and Microsoft users

"VoidProxy" PhishKit targets Google and Microsoft users

NSW gov third party-linked cyber incidents quadruple in two years

NSW gov third party-linked cyber incidents quadruple in two years

Log In

  |  Forgot your password?