RISK EVALUATION. Successful exploitation of these vulnerabilities could result in denial of service, improper privilege management, or potentially remote code execution.
A denial-of-service vulnerability due to an allocation of resources without limits or throttling.
CVE-2022-2650 has been assigned to this vulnerability.
A CVSS v3.1 base score of 3.7 has been calculated; the CVSS vector string is.
CVE-2023-4807 has been assigned to this vulnerability.
A CVSS v3.1 base score of 5.9 has been calculated; the CVSS vector string is.
CVE-2024-1182 has been assigned to this vulnerability.
A CVSS v3.1 base score of 7.0 has been calculated; the CVSS vector string is.
CVE-2024-1573 has been assigned to this vulnerability.
CVE-2024-1574 has been assigned to this vulnerability.
A CVSS v3.1 base score of 6.7 has been calculated; the CVSS vector string is.
MITIGATIONS. Versions 10.97.3 and later have mitigations for these vulnerabilities.
ICONICS and Mitsubishi Electric recommends updating the ICONICS Suite with the latest security patches as they become available.
ICONICS and Mitsubishi Electric is releasing security updates as critical fixes/rollup releases.
Refer to the ICONICS Whitepaper on Security Vulnerabilities, the most recent version of which can be found here, and to the Mitsubishi Electric security advisory for information on the availability of the security updates.
When remote access is required, use more secure methods, such as virtual private networks, recognizing VPNs may have vulnerabilities and should be updated to the most current version available.
Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.
No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.
These vulnerabilities have a high attack complexity.
This Cyber News was published on www.cisa.gov. Publication date: Tue, 02 Jul 2024 14:00:15 +0000