Mitsubishi Electric MELSEC PLC Multiple Vulnerabilities Advisory (CVE-2022-25155-25159)

Vulnerability Information ID: JVN#96577897 Title: Multiple Vulnerabilities in Multiple FA Products Provided by Mitsubishi Electric Corporation Disclosure Date: 2022/03/31 Last Updated: 2022/05/31 Affected Systems MELSEC iQ-F Series - FX5U(C) CPU Units: All Models, All Versions - FX5UJ CPU Units: All Models, All Versions MELSEC iQ-R Series - R00/01/02CPU: All Versions - R04/08/16/32/120(EN)CPU: All Versions - Whole CPU: All Versions - R08/16/32/120PCPU: All Versions - R08/16/32/120PSFCPU: All Versions - R16/32/64MTCPU: All Versions - RJ71GN11-T2: All Versions - RJ71GN11-EIP: All Versions - RJ71C24(-R2/R4): All Versions - RJ71EN71: All Versions - RJ71GF11-T2: All Versions - RJ71GF11-T2: All Versions - RJ72GF15-T2: All Versions MELSEC Q Series - Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: All Versions - Q03/04/06/13/26UDRCPU: All Versions - Q04/06/13/26UDPVCPU: All Versions - QJ71C24N(-R2/R4): All Versions - QJ71E71-100: All Versions - QJ72BR15: All Versions - QJ72LP25(-25/G/GE): All Versions MELSEC L Series - L02/06/26CPU(-P), L26CPU-(P)BT: All Versions - LJ71C24(-R2): All Versions - LJ71EN1-100: All Versions - LJ72GF15-T2: All Versions Vulnerability Details Authentication Using Password Alternatives (CVE-836) - CVE-2022-25155 - CVSS v3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/A:N - Base Score: 5.9 Use of Weak Hash Algorithm (CWE-32) - CVE-2022-25156 - CVSS v3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Base Score: 5.9 Authentication Using Password Alternatives (CVE-836) - CVE-2022-25157 - CVSS v3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Base Score: 7.4 Storage of Sensitive Information Management Requirements (CWE-312) - CVE-2022-25158 - CVSS v3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Base Score: 7.4 Authentication Bypass via Capture-Replay (CWE-294) - CVE-2022-25159 - CVSS v3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/

Goal Reached Thanks to every supporter — we hit 100%!

Mitsubishi Electric MELSEC PLC Multiple Vulnerabilities Advisory (CVE-2022-25155-25159)