¡¾Îó²îͨ¸æ¡¿ÈýÁâµç»ú¶à¸ö²úÆ·¾Ü¾øÐ§ÀÍÎó²î£¨CVE-2022-24946£©

Ðû²¼Ê±¼ä 2022-08-19


0x00 Îó²î¸ÅÊö

CVE   ID

CVE-2022-24946

·¢Ã÷ʱ¼ä

2022-08-19

Àà    ÐÍ

Dos

µÈ    ¼¶

¸ßΣ

Ô¶³ÌʹÓÃ

ÊÇ

Ó°Ïì¹æÄ£


¹¥»÷ÖØÆ¯ºó

µÍ

Óû§½»»¥

ÎÞ

PoC/EXP


ÔÚҰʹÓÃ


 

0x01 Îó²îÏêÇé

ÈýÁâµç»úÖêʽ»áÉ磨¼ò³ÆÈýÁâµç»ú£©ÊÇÒ»¼Ò´Óʹ¤Òµ×Ô¶¯»¯²úÆ·ºÍ»úµçÒ»Ì廯µÄ¹«Ë¾¡£ ¡£¡£¡£¡£¡£

6ÔÂ14ÈÕ£¬£¬£¬£¬£¬ÈýÁâµç»úÐû²¼Ç徲ͨ¸æ£¬£¬£¬£¬£¬¹ûÕæÁËÆä¶à¸ö²úƷϵÁÐÖÐÒ»¸ö¿Éµ¼Ö¾ܾøÐ§À͵ÄÇå¾²Îó²î£¨CVE-2022-24946£©£¬£¬£¬£¬£¬¸ÃÎó²îµÄCVSSÆÀ·ÖΪ7.5¡£ ¡£¡£¡£¡£¡£

ÈýÁâµç»ú¹«Ë¾ÌṩµÄMELSECϵÁÐCPUÄ£¿£¿£¿£¿£¿éºÍMELIPCϵÁÐÖб£´æ²»×¼È·µÄ×ÊÔ´Ëø¶¨Îó²î£¬£¬£¬£¬£¬µ±ÏòÄ¿µÄϵͳ·¢ËÍÌØÖÆÊý¾Ý°üʱ£¬£¬£¬£¬£¬ÊÜÓ°Ïì²úÆ·µÄÒÔÌ«ÍøÍ¨Ñ¶¹¦Ð§¿ÉÄÜ»áÄð³É¾Ü¾øÐ§ÀÍ (DoS)£¬£¬£¬£¬£¬ÐèÒª¶Ô²úÆ·¾ÙÐÐÏµÍ³ÖØÖòŻª»Ö¸´¡£ ¡£¡£¡£¡£¡£

 

Ó°Ïì¹æÄ£

MELSEC

ÊÜÓ°ÏìϵÁÐ

Ó°Ïì¹æÄ£

ÐÞ¸´°æ±¾

iQ-R ϵÁÐ

R12CCPU-V£º¹Ì¼þ°æ±¾ 16¼°Ö®Ç°µÄ°æ±¾

R12CCPU-V£º¹Ì¼þ°æ±¾ 17 »ò¸ü¸ß°æ±¾

QϵÁÐ

Q03UDECPU¡¢Q04/06/10/13/20/26/50/100UDEHCPU£ºÐòÁкÅǰ5λΪ24061¼°Ö®Ç°µÄ°æ±¾£»£»£»£»

Q03/04/06/13/26UDVCPU£ºÐòÁкÅǰ5λΪ24051¼°Ö®Ç°µÄ°æ±¾£»£»£»£»

Q04/06/13/26UDPVCPU£ºÐòÁкÅǰ5λΪ24051¼°Ö®Ç°µÄ°æ±¾£»£»£»£»

Q12DCCPU-V¡¢Q24DHCCPU-V(G)¡¢Q24/26DHCCPU-LS£ºËùÓа汾

Q03UDECPU¡¢Q04/06/10/13/20/26/50/100UDEHCPU£ºÐòÁкÅǰ 5 λΪ 24062»ò¸ü¸ß°æ±¾£»£»£»£»

Q03/04/06/13/26UDVCPU£ºÐòÁкÅǰ5λΪ24052»ò¸ü¸ß°æ±¾£»£»£»£»

Q04/06/13/26UDPVCPU£ºÐòÁкÅǰ5λΪ24052»ò¸ü¸ß°æ±¾£»£»£»£»

²¿·Ö²úÆ·ÏÖÔÚÉÐδÐÞ¸´¡£ ¡£¡£¡£¡£¡£

L ϵÁÐ

L02/06/26CPU(-P)¡¢L26CPU-(P)BT£ºÐòÁкÅǰ5λΪ24051¼°Ö®Ç°µÄ°æ±¾

L02/06/26CPU(-P)¡¢L26CPU-(P)BT£ºÐòÁкÅǰ5λΪ240522»ò¸ü¸ß°æ±¾

MELIPCϵÁÐ

Null

MI5122-VW£º¹Ì¼þ°æ±¾ 05 ¼°Ö®Ç°µÄ°æ±¾

MI5122-VW£º¹Ì¼þ°æ±¾ 06 »ò¸ü¸ß°æ±¾

 

0x02 Çå¾²½¨Òé

ÏÖÔÚ¸ÃÎó²îÒѾ­ÐÞ¸´£¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿É²Î¿¼Éϱíʵʱ¸üе½ÏìÓ¦ÐÞ¸´°æ±¾¡£ ¡£¡£¡£¡£¡£

ÏÂÔØÁ´½Ó£º

https://www.mitsubishielectric.com/fa/support/index.html

 

0x03 ²Î¿¼Á´½Ó

https://jvn.jp/vu/JVNVU90895626/index.html

https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-01

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf

 

0x04 °æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

ÐÞ¸ÄÄÚÈÝ

V1.0

2022-08-19

Ê×´ÎÐû²¼

 

0x05 ¸½Â¼

¼øºÚµ£±£Íø¼ò½é

¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£ ¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£ ¡£¡£¡£¡£¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬£¬£¬¹«Ë¾Ô±¹¤½ü4000ÈË£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£ ¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£ ¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£ ¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©

¶àÄêÀ´£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£ ¡£¡£¡£¡£¡£


¹ØÓÚ¼øºÚµ£±£Íø

¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£ ¡£¡£¡£¡£¡£

¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º

image.png