PT-2024-7388 · Mitsubishi · M800/M80/E80 Series+5

Published 2024-10-17 · Updated 2025-02-21 · CVE-2024-7316

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric M800V/M80V Series versions (affected versions not specified) Mitsubishi Electric M800/M80/E80 Series versions (affected versions not specified) Mitsubishi Electric C80 Series versions (affected versions not specified) Mitsubishi Electric M700V/M70V/E70 Series versions (affected versions not specified) Mitsubishi Electric CNC Series versions (affected versions not specified) Mitsubishi Electric Software Tools versions (affected versions not specified)

Description: The issue is related to improper validation of specified quantity in input, which can be exploited by a remote attacker to cause a Denial of Service (DoS) condition. This can be achieved by sending specially crafted TCP packets to port 683, potentially leading to an emergency stop. The estimated number of potentially affected devices worldwide is not available.

Recommendations: For Mitsubishi Electric M800V/M80V Series, consider restricting access to TCP port 683 until a patch is available. For Mitsubishi Electric M800/M80/E80 Series, avoid using the vulnerable input validation mechanism until the issue is resolved. For Mitsubishi Electric C80 Series, restrict access to the emergency stop function until a fix is provided. For Mitsubishi Electric M700V/M70V/E70 Series, consider disabling the remote access feature to minimize the risk of exploitation. For Mitsubishi Electric CNC Series, as a temporary workaround, consider disabling the TCP port 683 interface until a patch is available. For Mitsubishi Electric Software Tools, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1284

Related Identifiers

BDU:2024-08757

CVE-2024-7316

Affected Products

C80 Series

Cnc Series

M700V/M70V/E70 Series

M800/M80/E80 Series

M800V/M80V Series

Software Tools

References · 10

• https://bdu.fstec.ru/vul/2024-08757 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-007_en.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7316 · Security Note
• https://jvn.jp/vu/JVNVU92054409/index.html · Note
• https://twitter.com/CVEnew/status/1847038821591814502 · Twitter Post
• https://vuldb.com/?id.280865 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-291-03 · Note
• https://vulners.com/cve/CVE-2024-7316 · Note
• https://t.me/cvenotify/111956 · Telegram Post
• https://t.me/cvedetector/8258 · Telegram Post