published January 21, 2022
🚨 An unauthenticated attacker can bypass security and access sensitive data in Mitsubishi Electric's products just by sending a specially crafted WebSocket packet! 🔥 Think of it like a hotel with a faulty check-in system where anyone can walk in without a reservation—no questions asked! This vulnerability allows attackers to stroll right into your system and access confidential information. With this vulnerability, an attacker could gain unauthorized access to multiple products, including MC Works64, GENESIS64, and others, potentially compromising sensitive data and wreaking havoc on operations. It's a gateway for malicious actors to exploit your systems without breaking a sweat!
Think of it like a hotel with a faulty check-in system where anyone can walk in without a reservation—no questions asked! This vulnerability allows attackers to stroll right into your system and access confidential information. The incomplete list of disallowed inputs in these products allows an attacker to bypass authentication by sending specifically crafted WebSocket packets to the FrameWorX server, granting access without valid credentials.
With this vulnerability, an attacker could gain unauthorized access to multiple products, including MC Works64, GENESIS64, and others, potentially compromising sensitive data and wreaking havoc on operations. It's a gateway for malicious actors to exploit your systems without breaking a sweat! To secure your systems, immediately update to the latest versions of affected products: MC Works64 (4.04E and later), GENESIS64 (10.97 and later), Hyper Historian, AnalytiX, and MobileHMI. Monitor WebSocket traffic for unusual patterns and consider implementing additional authentication measures as a preventative step. You've got this! By following these steps, you're on your way to locking down your systems and keeping the bad guys out! 🛡️