CVE-2019-14930: Critical severity mitsubishielectric smartrtu firmware vulnerability
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.)
Other sources
An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-14930.
What is the severity of CVE-2019-14930?
The severity of CVE-2019-14930 is critical with a CVSS score of 9.8.
Which devices are affected by CVE-2019-14930?
Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0 are affected by CVE-2019-14930.
What is the impact of CVE-2019-14930?
The undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorized access to the RTU.
How can I fix CVE-2019-14930?
To fix CVE-2019-14930, it is recommended to update to the latest firmware version provided by Mitsubishi Electric or INEA.