Panasonic FPWIN Pro
Plan Patch7.3ICS-CERT ICSA-21-005-02Jan 5, 2021
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary
FPWIN Pro versions 7.5.0.0 and earlier contain an out-of-bounds read vulnerability (CWE-125) that can be triggered when opening a malicious file. This vulnerability affects the memory boundary checks in the software's file parsing logic. Successful exploitation may allow code execution on the affected workstation. The vulnerability is not remotely exploitable; it requires local file access and user interaction to open a malicious project file or attachment.
What this means
What could happen
An attacker with local access to a system running FPWIN Pro could read memory outside intended boundaries or execute arbitrary code, potentially compromising engineering workstations used to configure or monitor PLCs and control systems.
Who's at risk
Engineering staff and system integrators at utilities and manufacturers who use Panasonic FPWIN Pro to program, configure, and troubleshoot Panasonic FP-series PLCs and safety controllers. This affects any organization using Panasonic industrial automation equipment for process control, power distribution automation, or safety systems.
How it could be exploited
An attacker must trick a user into opening a malicious file (document, project file, or attachment) on a system running FPWIN Pro. Once opened, the out-of-bounds read vulnerability could allow the attacker to extract sensitive data from memory or escalate to remote code execution on that workstation.
Prerequisites
- Local file access on a system running FPWIN Pro version 7.5.0.0 or earlier
- User interaction required: victim must open a malicious file or project
- No authentication bypass needed; vulnerability exists in file parsing
Local file opening required (requires user interaction)Memory corruption vulnerability can lead to code executionAffects engineering workstations (confidentiality and integrity of control logic at risk)Low public exploit awareness reduces immediate detection likelihood
Exploitability
Low exploit probability (EPSS 0.4%)
Affected products (1)
ProductAffected VersionsFix Status
FPWIN Pro:≤ 7.5.0.07.5.0.1
Remediation & Mitigation
0/4
Do now
0/1WORKAROUNDDo not open unsolicited files, project archives, or email attachments from untrusted sources on engineering workstations
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate FPWIN Pro to version 7.5.0.1 or later
Long-term hardening
0/2HARDENINGImplement email filtering to block suspicious attachments at the gateway
HARDENINGIsolate engineering workstations running FPWIN Pro on a separate network segment with restricted internet access
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/2f6bac94-3798-4ecc-b4c2-d614615140fd