CVE-2023-28729
📋 TL;DR
A type confusion vulnerability in Panasonic Control FPWIN Pro allows arbitrary code execution when opening malicious project files. This affects all versions up to and including 7.6.0.3, putting industrial control system operators at risk.
💻 Affected Systems
- Panasonic Control FPWIN Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the engineering workstation leading to PLC reprogramming, process disruption, or lateral movement into OT networks.
Likely Case
Local privilege escalation or malware installation on engineering workstations used for PLC programming.
If Mitigated
Limited to isolated engineering workstation compromise if proper network segmentation is in place.
🎯 Exploit Status
Requires user interaction to open malicious project file. Type confusion vulnerabilities often lead to reliable exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.6.0.4 or later
Vendor Advisory: https://industry.panasonic.eu/factory-automation/programmable-logic-controllers-plc/plc-software/programming-software-control-fpwin-pro
Restart Required: Yes
Instructions:
1. Download latest version from Panasonic website. 2. Uninstall current version. 3. Install updated version. 4. Restart system.
🔧 Temporary Workarounds
Restrict project file execution
windowsBlock execution of .pro files or restrict to trusted sources only
User awareness training
allTrain users to only open project files from trusted sources
🧯 If You Can't Patch
- Isolate engineering workstations from production networks and internet
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check FPWIN Pro version in Help > About. If version is 7.6.0.3 or earlier, system is vulnerable.Check Version:
Not applicable - check via application GUI Help > AboutVerify Fix Applied:
Verify version is 7.6.0.4 or later in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Unexpected process creation from FPWIN Pro
- Abnormal file access patterns for .pro files
Network Indicators:
- Unusual outbound connections from engineering workstations
SIEM Query:
Process creation where parent_process contains 'fpwin' and process_name not in approved_list