ELECTRIC AUTOMATION INC PATCH
ELECTRIC AUTOMATION INC SOFTWARE

The insecure ActiveX control is located in the IcoLaunch.dll file. VULNERABILITY CHARACTERIZATION VULNERABILITY OVERVIEW MC-WorX Suite Version 8.02 is deployed across several sectors including Commercial Facilities, Critical Manufacturing, Energy, and Water and Wastewater Systems in the United States.

ELECTRIC AUTOMATION INC SOFTWARE

Mitsubishi Electric Automation, Inc, located in Vernon Hills, Illinois, is the primary location of the MC-WorX software product. NCCIC/ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. Impact to individual organizations depends on many factors that are unique to each organization.

ELECTRIC AUTOMATION INC PATCH

Mitsubishi Electric Automation, Inc has published a patch resolving this IcoLaunch.dll issue for the vulnerable version of the software. Using social engineering to get the victim to click the Login Client button, arbitrary malicious code could be launched from a remote share. The following Mitsubishi Electric Automation, Inc product is affected:ДЄn attacker crafting a script could assign arbitrary code to the Login Client button. Exploits that target this vulnerability are known to be publicly available. This vulnerability could be exploitable remotely, but requires user interaction. The currently available version of this product is MC-WorX v9.22 released in 2011, which is not vulnerable to this ActiveX vulnerability. Mitsubishi Electric Automation, Inc has developed a patch for the vulnerable version (8.02). The anonymous researcher, вЂњBlake,вЂќ identified an insecure ActiveX control vulnerability in Mitsubishi Electric AutomationвЂ™s MC-WorX application with proof-of-concept (PoC) code, without coordination with NCCIC/ICS-CERT, the vendor, or any other coordinating entity known to NCCIC/ICS-CERT. The original alert was prompted by an uncoordinated public web site release September 15, 2013, by an anonymous researcher. Published SeptemberВ 16, 2013, on the NCCIC/ICSвЂ‘CERT web site (this was originally incorrectly identified as MC-WorkX, the correct product name is MC-WorX). This advisory is a follow-up to the original alert, titled ICS-ALERT-13-259-01 MitsubishiВ MC-WorX Suite Unsecure ActiveX Control, a

Electric automation inc