¡¾Îó²îͨ¸æ¡¿ÈýÁâµç»ú¶à¸ö²úÆ·¾Ü¾øÐ§ÀÍÎó²î£¨CVE-2022-24946£©
Ðû²¼Ê±¼ä 2022-08-190x00 Îó²î¸ÅÊö
CVE ID | CVE-2022-24946 | ·¢Ã÷ʱ¼ä | 2022-08-19 |
Àà ÐÍ | Dos | µÈ ¼¶ | ¸ßΣ |
Ô¶³ÌʹÓà | ÊÇ | Ó°Ïì¹æÄ£ | |
¹¥»÷ÖØÆ¯ºó | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | ÔÚҰʹÓà |
0x01 Îó²îÏêÇé
ÈýÁâµç»úÖêʽ»áÉ磨¼ò³ÆÈýÁâµç»ú£©ÊÇÒ»¼Ò´Óʹ¤Òµ×Ô¶¯»¯²úÆ·ºÍ»úµçÒ»Ì廯µÄ¹«Ë¾¡£¡£¡£¡£¡£¡£
6ÔÂ14ÈÕ£¬£¬£¬£¬£¬ÈýÁâµç»úÐû²¼Ç徲ͨ¸æ£¬£¬£¬£¬£¬¹ûÕæÁËÆä¶à¸ö²úƷϵÁÐÖÐÒ»¸ö¿Éµ¼Ö¾ܾøÐ§À͵ÄÇå¾²Îó²î£¨CVE-2022-24946£©£¬£¬£¬£¬£¬¸ÃÎó²îµÄCVSSÆÀ·ÖΪ7.5¡£¡£¡£¡£¡£¡£
ÈýÁâµç»ú¹«Ë¾ÌṩµÄMELSECϵÁÐCPUÄ£¿£¿£¿£¿£¿éºÍMELIPCϵÁÐÖб£´æ²»×¼È·µÄ×ÊÔ´Ëø¶¨Îó²î£¬£¬£¬£¬£¬µ±ÏòÄ¿µÄϵͳ·¢ËÍÌØÖÆÊý¾Ý°üʱ£¬£¬£¬£¬£¬ÊÜÓ°Ïì²úÆ·µÄÒÔÌ«ÍøÍ¨Ñ¶¹¦Ð§¿ÉÄÜ»áÄð³É¾Ü¾øÐ§ÀÍ (DoS)£¬£¬£¬£¬£¬ÐèÒª¶Ô²úÆ·¾ÙÐÐÏµÍ³ÖØÖòŻª»Ö¸´¡£¡£¡£¡£¡£¡£
Ó°Ïì¹æÄ£
MELSEC | ||
ÊÜÓ°ÏìϵÁÐ | Ó°Ïì¹æÄ£ | ÐÞ¸´°æ±¾ |
iQ-R ϵÁÐ | R12CCPU-V£º¹Ì¼þ°æ±¾ 16¼°Ö®Ç°µÄ°æ±¾ | R12CCPU-V£º¹Ì¼þ°æ±¾ 17 »ò¸ü¸ß°æ±¾ |
QϵÁÐ | Q03UDECPU¡¢Q04/06/10/13/20/26/50/100UDEHCPU£ºÐòÁкÅǰ5λΪ24061¼°Ö®Ç°µÄ°æ±¾£»£»£»£» Q03/04/06/13/26UDVCPU£ºÐòÁкÅǰ5λΪ24051¼°Ö®Ç°µÄ°æ±¾£»£»£»£» Q04/06/13/26UDPVCPU£ºÐòÁкÅǰ5λΪ24051¼°Ö®Ç°µÄ°æ±¾£»£»£»£» Q12DCCPU-V¡¢Q24DHCCPU-V(G)¡¢Q24/26DHCCPU-LS£ºËùÓа汾 | Q03UDECPU¡¢Q04/06/10/13/20/26/50/100UDEHCPU£ºÐòÁкÅǰ 5 λΪ 24062»ò¸ü¸ß°æ±¾£»£»£»£» Q03/04/06/13/26UDVCPU£ºÐòÁкÅǰ5λΪ24052»ò¸ü¸ß°æ±¾£»£»£»£» Q04/06/13/26UDPVCPU£ºÐòÁкÅǰ5λΪ24052»ò¸ü¸ß°æ±¾£»£»£»£» ²¿·Ö²úÆ·ÏÖÔÚÉÐδÐÞ¸´¡£¡£¡£¡£¡£¡£ |
L ϵÁÐ | L02/06/26CPU(-P)¡¢L26CPU-(P)BT£ºÐòÁкÅǰ5λΪ24051¼°Ö®Ç°µÄ°æ±¾ | L02/06/26CPU(-P)¡¢L26CPU-(P)BT£ºÐòÁкÅǰ5λΪ240522»ò¸ü¸ß°æ±¾ |
MELIPCϵÁÐ | ||
Null | MI5122-VW£º¹Ì¼þ°æ±¾ 05 ¼°Ö®Ç°µÄ°æ±¾ | MI5122-VW£º¹Ì¼þ°æ±¾ 06 »ò¸ü¸ß°æ±¾ |
0x02 Çå¾²½¨Òé
ÏÖÔÚ¸ÃÎó²îÒѾÐÞ¸´£¬£¬£¬£¬£¬ÊÜÓ°ÏìÓû§¿É²Î¿¼Éϱíʵʱ¸üе½ÏìÓ¦ÐÞ¸´°æ±¾¡£¡£¡£¡£¡£¡£
ÏÂÔØÁ´½Ó£º
https://www.mitsubishielectric.com/fa/support/index.html
0x03 ²Î¿¼Á´½Ó
https://jvn.jp/vu/JVNVU90895626/index.html
https://www.cisa.gov/uscert/ics/advisories/icsa-22-172-01
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-007_en.pdf
0x04 °æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ÐÞ¸ÄÄÚÈÝ |
V1.0 | 2022-08-19 | Ê×´ÎÐû²¼ |
0x05 ¸½Â¼
¼øºÚµ£±£Íø¼ò½é
¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬£¬£¬¹«Ë¾Ô±¹¤½ü4000ÈË£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£¡£
¹ØÓÚ¼øºÚµ£±£Íø
¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£¡£¡£
¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º