Skip to content
OpenAdvisories
Medium ICSA-24-135-04 12 CVEs

Mitsubishi Electric Multiple FA Engineering Software Products (Update G)

Published May 14, 2024 · Updated Sep 1, 2026 · Revision 15

Vendor: Mitsubishi Electric Vendor: Mitsubishi Electric Iconics Digital Solutions Product: C Controller Interface Module utility (SW1DNC-QSCCF-B) Product: CC-Link IE Controller Network Interface Board software package (SW1DNC-MNETG-B) Product: CC-Link IE Field Network Interface Board software package (SW1DNC-CCIEF-J) Product: CC-Link System Master/Local Interface Board software package (SW1DNC-CCBD2-B) Product: CPU Module Logging Configuration Tool Product: CSGL (GX Works2 connection configuration) Product: CW Configurator Product: Data Transfer Product: Data Transfer Classic Product: EZSocket Product: FR Configurator SW3 Product: FR Configurator2 Product: GENESIS64 Product: GENESIS64 Product: GT Designer3 Version1 (GOT1000) Product: GT Designer3 Version1 (GOT2000) Product: GT SoftGOT1000 Version3 Product: GT SoftGOT2000 Version1 Product: GX Developer Product: GX LogViewer Product: GX Works2 Product: GX Works3 Product: ICONICS Suite Product: ICONICS Suite Product: iQ Works (MELSOFT Navigator) Product: MELSECNET/H Interface Board software package (SW0DNC-MNETH-B) Product: MELSOFT EM Software Development Kit (SW1DND-EMSDK-B) Product: MI Configurator +11 more

Summary

Multiple Vulnerabilities due to vulnerabilities in Jungo's WinDriver in multiple FA engineering software products. Successful exploitation of these vulnerabilities may allow a local attacker to cause a Windows blue screen error that results in a denial-of-service condition and/or to gain Windows system privileges and execute arbitrary commands.

Vulnerabilities 12

  • High 8.8
    CVE-2024-22106

    Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute a…

  • High 7.8
    CVE-2023-51776

    Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execut…

  • High 7.8
    CVE-2024-25086

    Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execut…

  • High 7.8
    CVE-2024-25088

    Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execut…

  • High 7.8
    CVE-2024-26314

    Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and…

  • Medium 5.5
    CVE-2023-51777

    Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue s…

  • Medium 5.5
    CVE-2023-51778

    Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.1.0 allows local attackers to cause a Windows blue scree…

  • Medium 5.5
    CVE-2024-22102

    Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue s…

  • Medium 5.5
    CVE-2024-22104

    Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue scree…

  • Medium 5.5
    CVE-2024-22105

    Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.5.1 allows local attackers to cause a Windows blue s…

  • Medium 5.5
    CVE-2024-25087

    Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 allows local attackers to cause a Windows blue s…

  • Medium 4.4
    CVE-2024-22103

    Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 allows local attackers to cause a Windows blue scree…

Revision history

  1. #15

    CISA Republication update based on Mitsubishi Electric 2024-001 advisory

  2. #14

    Updated the affected versions for GENESIS64 and ICONICS Suite. Added GENESIS64 and ICONICS Suite as updated products. Added a workaround for GENESIS64 and ICONICS Suite.

  3. #13

    CISA Republication update based on Mitsubishi Electric 2024-001 advisory

  4. #12

    CISA Republication - Update E - Added version information to affected product and mitigation sections.

  5. #11

    Added ICONICS Suite and MT Works2 to the "Affected Products" section. And added the updated products such as GENESIS, Mitsubishi Electric Numerical Control Device Communication Software (FCSB1224), PX Developer/Monitor Tool, RT VisualBox, C Controller Interface Module utility (SW1DNC-QSCCF-B), and MT Works2 to the "Countermeasures for Products" section.

  6. #10

    CISA Republication - Update D - Added version information to affected product and mitigation sections.

  7. #9

    Added the updated products such as CW Configurator, Setting/monitoring tools for the C Controller module (SW4PVC-CCPU), and MELSOFT EM Software Development Kit (SW1DND-EMSDK-B) to the "Countermeasures for Products" section.

  8. #8

    CISA Republication - Update C - Added version information for Position Board Utility2

  9. #7

    Added products for which there are no plans for release fixed versions to the "Countermeasures for Customers" section. And added Position Board Utility2 (MRZJW3-MC2-UTL) to the "Countermeasures for Products" section as a updated product.

  10. #5

    CISA Republication - Update B - Added version information to affected product and mitigation sections.

  11. #6

    Added guidance for products that do not provide downloadable updates to the "Countermeasures for Customers" section. And added the updated products such as CPU Module Logging Configuration Tool, CSGL (GX Works2 connection configuration), EZSocket, FR Configurator2, GX LogViewer, GX Works2, GX Works3, iQ Works (MELSOFT Navigator), and MX Component to the "Countermeasures for Products" section.

  12. #4

    CISA Republication - Update A - Added version information to affected product and mitigation sections.

  13. #3

    In the "Affected Products" section, the product names of Position Board Utility2 (MRZJW3-MC2-UTL), MELSECNET/H Interface Board software package (SW0DNC-MNETH-B), CC-Link System Master/Local Interface Board software package (SW1DNC-CCBD2-B), CC-Link IE Field Network Interface Board software package (SW1DNC-CCIEF-J/-B), CC-Link IE Controller Network Interface Board software package (SW1DNC-MNETG-B), C Controller Interface Module utility (SW1DNC-QSCCF-B), and MELSOFT EM Software Development Kit (SW1DND-EMSDK-B) have been revised. The description regarding "Countermeasures for Customers" has also been revised. Additionally, a "Countermeasures for Products" section has been added, listing the products that have been fixed.

  14. #2

    CISA Republication - Initial Republication of Mitsubishi Electric 2024-001

  15. #1

    Initial Publication

References