Mitsubishi Electric MELSEC iQ-F Series Improper Validation of Specified Type of Input (CVE-2024-8403)

high Tenable OT Security Plugin ID 502684

Synopsis

The remote OT asset is affected by a vulnerability.

Description

A denial-of-service vulnerability due to improper validation of a specified type of input exists in MELSEC iQ-F Ethernet Module and EtherNet/IP Module.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Mitsubishi Electric has fixed this issue in MELSEC iQ-F Series FX5-ENET/IP version 1.106 or later. The firmware update file can be found on Mitsubishi Electric's download page. Refer to "9 FIRMWARE UPDATE FUNCTION" in the "MELSEC iQ-F FX5 User's Manual (Application)" for information on how to update the firmware.

Mitsubishi Electric recommends that users take the following mitigations/workarounds to minimize the risk of exploiting this vulnerability:

- Use within a LAN and block access from untrusted networks and hosts through firewalls.
- Restrict physical access to the product, as well as to computers and network devices located within the same network as the product.
- Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when internet access is required.
- Use IP filter function to block access from untrusted hosts. For details on the IP filter function, please refer to the following manual: MELSEC iQ-F FX5 User's Manual (Communication) "13.1 IP Filter Function"

For specific update instructions and additional details see the Mitsubishi Electric advisory.

Please contact your local Mitsubishi Electric representative.

Plugin Details

Severity: High

ID: 502684

Version: 1.3

Type: remote

Family: Tenable.ot

Published: 11/27/2024

Updated: 12/12/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:mitsubishielectric:fx5-enet%2fip_firmware, cpe:/o:mitsubishielectric:fx5-enet_firmware

Required KB Items: Tenable.ot/Mitsubishi

Exploit Ease: No known exploits are available

Patch Publication Date: 11/19/2024

Vulnerability Publication Date: 11/19/2024

Reference Information

CVE: CVE-2024-8403

CWE: 1287

ICSA: 24-324-01

Detections

Analytics