CVE-2023-51778
📋 TL;DR
This CVE describes an out-of-bounds write vulnerability in Jungo WinDriver that allows local attackers to trigger a Windows blue screen error, causing a denial of service. The vulnerability affects systems running WinDriver versions before 12.1.0, primarily impacting industrial control systems and embedded devices that use this driver development toolkit.
💻 Affected Systems
- Jungo WinDriver
📦 What is this software?
Cpu Module Logging Configuration Tool by Mitsubishielectric
View all CVEs affecting Cpu Module Logging Configuration Tool →
Cw Configurator by Mitsubishielectric
Data Transfer by Mitsubishielectric
Data Transfer Classic by Mitsubishielectric
Ezsocket by Mitsubishielectric
Fr Configurator Sw3 by Mitsubishielectric
Fr Configurator2 by Mitsubishielectric
Genesis64 by Mitsubishielectric
Gt Got1000 by Mitsubishielectric
Gt Got2000 by Mitsubishielectric
Gt Softgot1000 by Mitsubishielectric
Gt Softgot2000 by Mitsubishielectric
Gx Developer by Mitsubishielectric
Gx Logviewer by Mitsubishielectric
Gx Works2 by Mitsubishielectric
Gx Works3 by Mitsubishielectric
Iq Works by Mitsubishielectric
Mi Configurator by Mitsubishielectric
Mr Configurator by Mitsubishielectric
Mr Configurator2 by Mitsubishielectric
Mrzjw3 Mc2 Utl Firmware by Mitsubishielectric
Mx Component by Mitsubishielectric
Mx Opc Server Da\/ua by Mitsubishielectric
Numerical Control Device Communication by Mitsubishielectric
View all CVEs affecting Numerical Control Device Communication →
Px Developer\/monitor Tool by Mitsubishielectric
Rt Toolbox3 by Mitsubishielectric
Rt Visualbox by Mitsubishielectric
Sw0dnc Mneth B Firmware by Mitsubishielectric
Sw1dnc Ccbd2 B Firmware by Mitsubishielectric
Sw1dnc Ccief B Firmware by Mitsubishielectric
Sw1dnc Ccief J Firmware by Mitsubishielectric
Sw1dnc Mnetg B Firmware by Mitsubishielectric
Sw1dnc Qsccf B Firmware by Mitsubishielectric
Sw1dnd Emsdk B Firmware by Mitsubishielectric
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash requiring physical reboot, potentially disrupting critical industrial processes or embedded systems that rely on WinDriver for hardware communication.
Likely Case
Local denial of service through system crash, requiring reboot to restore functionality. This could interrupt operations in industrial environments.
If Mitigated
Minimal impact if proper access controls prevent local users from executing malicious code or if systems are patched to version 12.1.0 or later.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability is an out-of-bounds write that can be triggered to cause a blue screen. No public proof-of-concept has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.0 and later
Vendor Advisory: https://jungo.com/windriver/versions/
Restart Required: Yes
Instructions:
1. Download WinDriver version 12.1.0 or later from Jungo's website. 2. Uninstall the current WinDriver version. 3. Install the updated version. 4. Reboot the system to ensure the new driver loads properly.
🔧 Temporary Workarounds
Restrict Local Access
windowsLimit local user access to systems running vulnerable WinDriver versions to reduce attack surface.
Application Whitelisting
windowsImplement application control policies to prevent unauthorized programs from executing on affected systems.
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges on affected systems
- Isolate affected systems from general user networks and implement network segmentation
🔍 How to Verify
Check if Vulnerable:
Check the WinDriver version in the installed programs list or via the driver properties in Device Manager. Versions before 12.1.0 are vulnerable.Check Version:
Check Control Panel > Programs and Features for WinDriver version, or examine driver properties in Device ManagerVerify Fix Applied:
Verify that WinDriver version 12.1.0 or later is installed and check that no older versions are present in the system.📡 Detection & Monitoring
Log Indicators:
- Windows System logs showing unexpected blue screen events (BugCheck codes)
- Application logs showing WinDriver-related errors or crashes
Network Indicators:
- No specific network indicators as this is a local vulnerability
SIEM Query:
EventID=41 OR EventID=1001 AND Source="Microsoft-Windows-Kernel-Power" OR Source="Microsoft-Windows-WER-SystemErrorReporting"🔗 References
- https://jungo.com/windriver/versions/
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
- https://jungo.com/windriver/versions/
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
