Executive Summary

This vulnerability in Mitsubishi Electric's MELSEC iQ-F Series CPU modules is due to missing authentication for critical functions. It allows a remote unauthenticated attacker to read or write device values and stop program operations because the MODBUS/TCP protocol used does not have authentication features. Essentially, attackers can remotely access and manipulate the device without needing credentials. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized reading and modification of device values and can stop the operation of programs running on the affected devices. This can cause information leakage, data tampering, and denial of service (DoS), potentially disrupting industrial control processes and causing operational failures. [1]

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying Mitsubishi Electric MELSEC iQ-F Series CPU modules on the network and checking for unauthenticated MODBUS/TCP communications. Network scanning tools can be used to detect devices responding on MODBUS/TCP ports (typically port 502). Monitoring for unauthorized read/write commands or unexpected program stops on these devices may indicate exploitation attempts. Specific commands are not provided in the available resources. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the vendor-recommended mitigation and workaround measures as no firmware updates are planned. These may involve restricting network access to the affected devices, implementing network segmentation, using firewalls to block unauthorized MODBUS/TCP traffic, and monitoring for suspicious activity. Detailed mitigation instructions are available from Mitsubishi Electric and associated ICS advisories. [1]

Useful 0 Not Useful 0