Full Report
The vulnerabilities could allow an attacker to read arbitrary files or cause a denial-of-service condition
Analysis Summary
Based on the provided information regarding the security update for Mitsubishi Electric FR Configurator2, here is the summarized vulnerability report.
# Vulnerability: Multiple Flaws in Mitsubishi Electric FR Configurator2
## CVE Details
- **CVE ID:** CVE-2019-10978, CVE-2019-10982
- **CVSS Score:** 7.1 (High)
- **CWE:** CWE-611 (Improper Restriction of XML External Entity Reference), CWE-400 (Uncontrolled Resource Consumption)
## Affected Systems
- **Products:** Mitsubishi Electric FR Configurator2 (Inverter Setup Software)
- **Versions:** All versions prior to 1.19V
- **Configurations:** Systems where the software is used to process project files or XML-based data from untrusted sources.
## Vulnerability Description
The software contains two primary vulnerabilities related to how it processes data:
1. **XML External Entity (XXE) Insertion (CVE-2019-10978):** The application improperly handles XML external entities. By persuading a user to open a specially crafted project file, an attacker can cause the application to disclose arbitrary files from the victim's local file system.
2. **Denial of Service (CVE-2019-10982):** A flaw in resource management allows an attacker to provide malicious input that consumes excessive system resources (CPU/Memory), leading to an application crash or system hang-up.
## Exploitation
- **Status:** PoC available (Publicly disclosed at the time of the advisory)
- **Complexity:** Medium (User interaction is required)
- **Attack Vector:** Local (Typically involves a user opening a malicious file sent via email or web download)
## Impact
- **Confidentiality:** High (Arbitrary file read capability)
- **Integrity:** None
- **Availability:** High (Inability to use the configuration software)
## Remediation
### Patches
- **Mitsubishi Electric FR Configurator2 Version 1.19V or later:** Users should update to this version or newer to resolve the vulnerabilities.
### Workarounds
- Do not open FR Configurator2 project files (e.g., .frc2) received from untrusted or unknown sources.
- Restrict folder permissions where project files are stored to prevent unauthorized modification.
## Detection
- **Indicators of Compromise:** Unexpected outbound network connections on ports commonly used for file exfiltration (HTTP/FTP/SMB) originating from the FR Configurator2 process.
- **Detection methods:** Use EDR or AV tools to monitor for the creation or execution of suspicious `.frc2` files.
## References
- **Vendor Advisory:** hxxps[://]www[.]mitsubishielectric[.]com/en/capabilities/infosecurity/advisory/pdf/2019-001[.]pdf
- **ICS-CERT Advisory:** hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/icsa-19-141-03
- **Kaspersky ICS CERT:** hxxps[://]ics-cert[.]kaspersky[.]com/advisories/2019/07/26/vulnerabilities-fixed-in-mitsubishi-electric-fr-configurator2/