Mitsubishi manufacturing controller software inherited OpenSSL bugs

Mitsubishi Electric industrial control software deployed on a global basis is vulnerable to critical OpenSSL vulnerabilities that were discovered earlier this year.

US Cyber Security and Infrastructure Security Agency (CISA) warns that the company’s GT SoftGOT2000 is used in critical manufacturing applications.

GT SoftGOT2000 emulates the company’s GOT controllers on PCs, offering control over everything from PLCs to industrial robots.

The software is vulnerable to the controversial CVE-2022-1292 command injection bug, which in June sparked arguments over whether or not it offered a remote code execution vector.

That question must have been resolved, since the CISA alert assigns a Common Vulnerabilities Scoring System score of 9.8 to the bug, making it critical.

The other OpenSSL vulnerability, CVE-2022-0778, is an infinite loop denial-of-service bug discovered by Google researcher Tavis Ormandy in February and 
patched in March.

Mitsubishi said (pdf) the bugs are fixed in GT SoftGOT2000 version 1.280S or later.