PT-2019-12112 · Mitsubishi · Fr Configurator2

Published 2019-07-25 · Updated 2020-10-02 · CVE-2019-10972

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric FR Configurator2 versions 1.16S and prior

Description The issue occurs when an attacker provides a rogue project file (.frc2) to the target. Upon opening the rogue project, CPU exhaustion happens, causing the software to stop responding until it is restarted.

Recommendations For versions 1.16S and prior, avoid opening project files from untrusted sources to minimize the risk of exploitation. As a temporary workaround, consider implementing measures to monitor and limit CPU usage to prevent exhaustion.

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2019-10972

Affected Products

Fr Configurator2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-10972 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10972 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-19-204-01 · Note