ICONICS Suite and Mitsubishi Electric MC Works64 Products

1. EXECUTIVE SUMMARY

• CVSS v3 9.8
• ATTENTION: Low attack complexity
• Vendors: ICONICS, Mitsubishi Electric
• Equipment: ICONICS Product Suite, MC Works64
• Vulnerabilities: Path Traversal, Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere, Out-of-Bounds Read

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could result in information disclosure, remote code execution, or a denial-of-service condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following SCADA products are affected:

• ICONICS GENESIS64: Version 10.97.1 and prior
• ICONICS Hyper Historian: Version 10.97.1 and prior
• ICONICS AnalytiX: Version 10.97.1 and prior
• ICONICS IoTWorX: Versions 10.97 and 10.97.1
• ICONICS MobileHMI: Versions 10.97 and 10.97.1
• ICONICS GraphWorX64: Version 10.97.1 and prior
• ICONICS GenBrokerX64: Version 10.97.1 and prior
• Mitsubishi Electric MC Works64: Version 4.04E (v10.95.210.01) and prior (excluding CVE-2022-29834)

3.2 VULNERABILITY OVERVIEW

3.2.1    IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22

ICONICS MobileHMI and IoTWorX IoT Visualizer products are affected by a path traversal vulnerability. If exploited, then this could allow traversing of the file system and access to files or directories that are outside the restricted directory on the MobileHMI server or the IoTWorX IoT Visualizer server. This traversal could then result in information disclosure.

CVE-2022-29834 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

3.2.2    DESERIALIZATION OF UNTRUSTED DATA CWE-502

GraphWorX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, has multiple vulnerabilities regarding the deserialization of untrusted data that, if exploited, could result in code execution.

CVE-2022-33315 and CVE-2022-33316 have been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.3    INCLUSION OF FUNCTIONALITY FROM UNTRUSTED CONTROL SPHERE CWE-829

GraphWorX64 scripting, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, is based on JScript and .NET. It stores script code in the GraphWorX64 project files. These project files could be directly edited that could result in code execution if exploited.

CVE-2022-33317 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.2.4    DESERIALIZATION OF UNTRUSTED DATA CWE-502

GenBrokerX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, contains a deserialization vulnerability that could result in remote code execution if exploited.

CVE-2022-33318 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.2.5    OUT-OF-BOUNDS READ CWE-125

GenBrokerX64, contained in all ICONICS Suite products and Mitsubishi Electric MC Works64 products, contains an out-of-bounds read issue which could result in information disclosure or a denial-of-service condition if exploited.

CVE-2022-33319 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).

3.2.6    DESERIALIZATION OF UNTRUSTED DATA CWE-502

All ICONICS Suite and Mitsubishi Electric MC Works64 products contain a deserialization vulnerability that could enable malicious project configuration files to execute arbitrary code via XML code on the files.

CVE-2022-33320 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: ICONICS is headquartered in the United States; Mitsubishi Electric is headquartered in Japan

3.4 RESEARCHER

Chris Anastasio, Noam Moshe of Claroty Research, Steven Seeley, Alex Birmberg, Ben McBride, and Axel '0vercl0k' Souchet, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA.

4. MITIGATIONS

ICONICS and Mitsubishi Electric recommend updating the ICONICS Suite and MC Works64 software with the latest security patches as they become available. ICONICS Suite security patches may be found here (login required) and MC Works64 security patches may be found here.

ICONICS and Mitsubishi Electric are releasing security updates as critical fixes/rollup releases and security patches. Refer to the ICONICS Whitepaper on Security Vulnerabilities, the most recent version of which can be found here, and to the Mitsubishi Electric’s security advisory for information on the availability of the security updates. Note: ICONICS and Mitsubishi Electric products version 10.97.2 and later are not vulnerable to these exploits.

ICONICS and Mitsubishi Electric recommend users of these products take the following mitigation steps:

• Use a firewall; consider using a Web Application Firewall (WAF). Place control system networks and devices behind firewalls and isolate them from the business network.
• Restrict access to all TCP ports such as port 38080 and 6002. If remote access is required, utilize secure remote access methods, such as Virtual Private Networks (VPNs).
• Minimize network exposure for all control system devices. Control system devices should not directly face the internet.
• Minimize the attack surface by turning off services and point managers which will not be used.
• Do not click web links or open unsolicited attachments in email messages.
• Install the applicable critical fixes/rollup releases when available.

Mitsubishi Electric also recommends specific action for specific versions of MC Works64:

• For users with MC Works64 Version 4.00 through 4.03D, contact Mitsubishi Electric to receive the Version 4.04E installer. Apply the latest security patches once updated.
• For users with MC Works64 Version 3.04E and prior, contact Mitsubishi Electric for assistance.

Additional information and useful links are found on the ICONICS GENESIS64 security updates page.

Additional information and useful links are found on Mitsubishi Electric’s security advisory.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability these vulnerabilities. Specifically, users should:

• Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolate them from business networks.
• When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely.

• ICONICS, Mitsubishi Electric