The affected products, QJ71E71-100, QJ71E71-B5, and QJ71E71-B2, are Ethernet interface modules that connect the MELSEC-Q series programmable controllers to the host network.

Mitsubishi Electric is a Japan-based company that maintains offices in several countries around the world. ICS-CERT recommends that organizations evaluate the impact of these vulnerabilities based on their operational environment, architecture, and product implementation. Impact to individual organizations depends on many factors that are unique to each organization. Successful exploitation of these vulnerabilities may allow an attacker to intercept weakly encrypted passwords and allow an unauthenticated remote attacker to cause a denial of service on the affected system. The following MELSEC-Q series versions are affected: These vulnerabilities could be exploited remotely.Įxploits that target these vulnerabilities are known to be publicly available. Mitsubishi Electric has created a product revision for newer devices that incorporates a compensating control to reduce the risk of exploitation for one of the identified vulnerabilities. NCCIC/ICS-CERT and JPCERT have coordinated the reported vulnerabilities with Mitsubishi Electric.

(Mitsubishi Electric) MELSEC-Q series Ethernet interface modules. Security researcher Vladimir Dashchenko of Critical Infrastructure Defense Team, Kaspersky Lab has identified vulnerabilities in the Mitsubishi Electric Automation, Inc.

Mitsubishi melsec plc