Mitsubishi manufacturing controller software inherited OpenSSL bugs

By

CISA warns about remote code execution, DoS exploits.

Mitsubishi Electric industrial control software deployed on a global basis is vulnerable to critical OpenSSL vulnerabilities that were discovered earlier this year.

Mitsubishi manufacturing controller software inherited OpenSSL bugs

US Cyber Security and Infrastructure Security Agency (CISA) warns that the company’s GT SoftGOT2000 is used in critical manufacturing applications.

GT SoftGOT2000 emulates the company’s GOT controllers on PCs, offering control over everything from PLCs to industrial robots.

The software is vulnerable to the controversial CVE-2022-1292 command injection bug, which in June sparked arguments over whether or not it offered a remote code execution vector.

That question must have been resolved, since the CISA alert assigns a Common Vulnerabilities Scoring System score of 9.8 to the bug, making it critical.

The other OpenSSL vulnerability, CVE-2022-0778, is an infinite loop denial-of-service bug discovered by Google researcher Tavis Ormandy in February and 
patched in March.

Mitsubishi said (pdf) the bugs are fixed in GT SoftGOT2000 version 1.280S or later.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Melbourne dev finds gift card PINs can be brute-forced

Melbourne dev finds gift card PINs can be brute-forced

"Widespread data theft" hits Salesforce customers via third party

"Widespread data theft" hits Salesforce customers via third party

Zero-click Apple and WhatsApp bug combo used to drop gov spyware

Zero-click Apple and WhatsApp bug combo used to drop gov spyware

Western Sydney University targets file-sharing sites hosting stolen data

Western Sydney University targets file-sharing sites hosting stolen data

Log In

  |  Forgot your password?