Mitsubishi Electric FA Engineering Software: GX Works3 Vulnerabilities

The GX Works3 impacts the control and monitoring of various processes, including electricity distribution, water treatment, transportation, and manufacturing. Exploiting these flaws might provide hostile actors with unauthorized access to ICS/PLC networks, possibly modifying a system’s operational settings or data. An attacker, for example, may change temperature control setpoints in a chemical facility, causing harmful reactions or mishaps. They might cause havoc on power systems by tampering with load-balancing algorithms or command-generating processes. An attacker might inflict physical damage to equipment or create system malfunctions that result in downtime with severe repercussions. These flaws highlight the importance of comprehensive cybersecurity solutions designed particularly for industrial control systems. To protect against such threats, CISA recommends to

• Install the latest version described in the Mitsubishi Electric advisory into the default installation folder. If it is necessary to change the installation folder from the default, select a folder that only users with Administrator privileges have permission to change.
• Install an antivirus software on the computer using the affected product.
• Use your computer with the affected product within the LAN and block remote login from untrusted networks, hosts, and users.
• When connecting your computer with the affected product to the Internet, use a firewall, virtual private network (VPN), etc., and allow only trusted users to remote login.
• Do not open untrusted files or click untrusted links.