Skip to content
OpenAdvisories
Medium ICSA-23-278-03 2 CVEs

Mitsubishi Electric CC-Link IE TSN Industrial Managed Switch (Update A)

Published Oct 5, 2023 · Updated Jun 4, 2024 · Revision 2

Vendor: Mitsubishi Electric Product: CC-Link IE TSN Industrial Managed Switch NZ2MHG-TSNT4 Product: CC-Link IE TSN Industrial Managed Switch NZ2MHG-TSNT8F2

Summary

Successful exploitation of these vulnerabilities could result in disclosure of information stored in the product by sending specially crafted packets or could cause a denial-of service (DoS) condition by getting a legitimate user to import a specially crafted certificate.

Vulnerabilities 2

  • High 7.5
    CVE-2022-4450 EPSS 29%

    Double free after calling PEM_read_bio_ex

    The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io
  • Medium 5.9
    CVE-2022-4304 Public exploit EPSS 24%

    Timing Oracle in RSA Decryption

    A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io

Revision history

  1. #2

    Update A - Updated affected product version range, updated mitigations.

  2. #1

    Initial Publication

References