Mitsubishi Electric FA Engineering Software (Update B)

An attacker with access to engineering workstation files could cause a denial-of-service condition on the PLC by crafting a malicious project file that crashes the software when opened or executed.

Engineering staff at electric utilities, water authorities, and energy facilities who use Mitsubishi Electric FA software tools (MELSOFT Navigator, GX Works2, EZSocket) to configure and maintain programmable logic controllers (PLCs). Impact is primarily to engineering productivity rather than immediate operational disruption, but could prevent PLC updates or configuration changes during critical periods.

An attacker could create a malicious project file and either place it on an engineering workstation or trick an operator into opening it using the "Batch Read" function. When the project file is parsed by the vulnerable software, a buffer over-read or integer underflow in the file parser causes the application to crash, disrupting engineering activities.