An issue exists on Mitsubishi Electric ME-RTU devices up to and including 2.02 and INEA ME-RTU devices up to and including 3.0. Stored cleartext passwords could allow an unauthenticated malicious user to obtain configured username and password combinations on the RTU due to the weak credentials management on the RTU. An unauthenticated user can obtain the exposed password credentials to gain access to the following services: DDNS service, Mobile Network Provider, and OpenVPN service.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
mitsubishielectric smartrtu_firmware |
||
inea me-rtu_firmware |
Vulmon