Jinyoung Kim

**Name of the Vulnerable Software and Affected Versions** Mitsubishi Electric Corporation GOT2000 Series GT27 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT25 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT23 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT2000 Series GT21 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT SIMPLE Series GS25 versions 01.49.000 and prior Mitsubishi Electric Corporation GOT SIMPLE Series GS21 versions 01.49.000 and prior Mitsubishi Electric Corporation GT Designer3 Version1 (GOT2000) versions 1.295H and prior Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.295H and prior **Description** The issue allows a remote unauthenticated attacker to obtain plaintext passwords by sniffing packets containing encrypted passwords and decrypting the encrypted passwords. This can occur when transferring data with GT Designer3 Version1(GOT2000) and GOT2000 Series or GOT SIMPLE Series with the Data Transfer Security function enabled, or when transferring data by the SoftGOT-GOT link function with GT SoftGOT2000 and GOT2000 series with the Data Transfer Security function enabled. **Recommendations** For Mitsubishi Electric Corporation GOT2000 Series GT27 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT25 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT23 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT2000 Series GT21 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT SIMPLE Series GS25 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GOT SIMPLE Series GS21 versions 01.49.000 and prior, update to a version later than 01.49.000. For Mitsubishi Electric Corporation GT Designer3 Version1 (GOT2000) versions 1.295H and prior, update to a version later than 1.295H. For Mitsubishi Electric Corporation GT SoftGOT2000 versions 1.295H and prior, update to a version later than 1.295H. As a temporary workaround, consider disabling the Data Transfer Security function until a patch is available. Restrict access to the data transfer functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mitsubishi Electric Corporation MELSEC iQ-F Series versions all Mitsubishi Electric Corporation MELSEC iQ-R Series versions all Mitsubishi Electric Corporation MELSEC-Q Series versions all Mitsubishi Electric Corporation MELSEC-L Series versions all Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U CPU modules version all Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U(C) CPU modules version all Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ CPU modules version all Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S CPU modules version all Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET version all Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP version all **Description** The issue concerns a Plaintext Storage of a Password vulnerability, allowing a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into the FTP server or Web server. **Recommendations** For Mitsubishi Electric Corporation MELSEC iQ-F Series, consider disabling the storage of plaintext passwords in project files until a patch is available. For Mitsubishi Electric Corporation MELSEC iQ-R Series, restrict access to the FTP server and Web server to minimize the risk of exploitation. For Mitsubishi Electric Corporation MELSEC-Q Series, avoid using plaintext credentials in project files until the issue is resolved. For Mitsubishi Electric Corporation MELSEC-L Series, restrict access to the FTP server and Web server to minimize the risk of exploitation. For Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U CPU modules, consider disabling the storage of plaintext passwords in project files until a patch is available. For Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U(C) CPU modules, restrict access to the FTP server and Web server to minimize the risk of exploitation. For Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ CPU modules, avoid using plaintext credentials in project files until the issue is resolved. For Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S CPU modules, restrict access to the FTP server and Web server to minimize the risk of exploitation. For Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET, consider disabling the storage of plaintext passwords in project files until a patch is available. For Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP, restrict access to the FTP server and Web server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LS ELECTRIC XBC-DN32U version 01.80 **Description** The issue is related to missing authentication for critical functions in the PLC, which could allow an attacker to change the PLC's mode arbitrarily. **Recommendations** For LS ELECTRIC XBC-DN32U version 01.80, consider implementing authentication mechanisms to restrict access to critical functions until a patch is available. As a temporary workaround, restrict access to the PLC to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** LS ELECTRIC XBC-DN32U version 01.80 **Description** The issue is related to the absence of authentication for a critical function in the programmable logic controller's software. This could allow a remote attacker to elevate their privileges and gain control of the device by creating an account with elevated privileges. **Recommendations** For LS ELECTRIC XBC-DN32U version 01.80, consider implementing authentication mechanisms to restrict access to critical functions, such as user creation on the PLC, until a patch is available. As a temporary workaround, restrict access to the device to minimize the risk of exploitation.