CVE-2024-25087
📋 TL;DR
A local Denial of Service vulnerability in Jungo WinDriver allows attackers with local access to cause a Windows blue screen error (BSOD), crashing the system. This affects Windows systems running WinDriver versions before 12.7.0. The vulnerability requires local access to exploit.
💻 Affected Systems
- Jungo WinDriver
📦 What is this software?
Cpu Module Logging Configuration Tool by Mitsubishielectric
View all CVEs affecting Cpu Module Logging Configuration Tool →
Cw Configurator by Mitsubishielectric
Data Transfer by Mitsubishielectric
Data Transfer Classic by Mitsubishielectric
Ezsocket by Mitsubishielectric
Fr Configurator Sw3 by Mitsubishielectric
Fr Configurator2 by Mitsubishielectric
Genesis64 by Mitsubishielectric
Gt Got1000 by Mitsubishielectric
Gt Got2000 by Mitsubishielectric
Gt Softgot1000 by Mitsubishielectric
Gt Softgot2000 by Mitsubishielectric
Gx Developer by Mitsubishielectric
Gx Logviewer by Mitsubishielectric
Gx Works2 by Mitsubishielectric
Gx Works3 by Mitsubishielectric
Iq Works by Mitsubishielectric
Mi Configurator by Mitsubishielectric
Mr Configurator by Mitsubishielectric
Mr Configurator2 by Mitsubishielectric
Mrzjw3 Mc2 Utl Firmware by Mitsubishielectric
Mx Component by Mitsubishielectric
Mx Opc Server Da\/ua by Mitsubishielectric
Numerical Control Device Communication by Mitsubishielectric
View all CVEs affecting Numerical Control Device Communication →
Px Developer\/monitor Tool by Mitsubishielectric
Rt Toolbox3 by Mitsubishielectric
Rt Visualbox by Mitsubishielectric
Sw0dnc Mneth B Firmware by Mitsubishielectric
Sw1dnc Ccbd2 B Firmware by Mitsubishielectric
Sw1dnc Ccief B Firmware by Mitsubishielectric
Sw1dnc Ccief J Firmware by Mitsubishielectric
Sw1dnc Mnetg B Firmware by Mitsubishielectric
Sw1dnc Qsccf B Firmware by Mitsubishielectric
Sw1dnd Emsdk B Firmware by Mitsubishielectric
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash requiring physical or remote console access to reboot, potentially disrupting critical operations and causing data loss from unsaved work.
Likely Case
Temporary system unavailability requiring reboot, disrupting user productivity and potentially affecting services running on the affected system.
If Mitigated
Minimal impact if proper access controls prevent unauthorized local access and systems are regularly backed up.
🎯 Exploit Status
Exploitation requires local access to the system. No public exploit code has been identified, but the vulnerability is straightforward to trigger based on the description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.7.0
Vendor Advisory: https://jungo.com/windriver/versions/
Restart Required: Yes
Instructions:
1. Download WinDriver 12.7.0 or later from Jungo's website. 2. Uninstall the current vulnerable version. 3. Install the updated version. 4. Reboot the system to complete the installation.
🔧 Temporary Workarounds
Restrict Local Access
windowsLimit local login access to only authorized administrators to reduce attack surface.
Disable Unused WinDriver Services
windowsIf WinDriver functionality is not required, disable or remove the software entirely.
🧯 If You Can't Patch
- Implement strict access controls to limit local system access to trusted users only.
- Monitor system logs for unauthorized access attempts and unexpected system crashes.
🔍 How to Verify
Check if Vulnerable:
Check WinDriver version in Control Panel > Programs and Features or by running the WinDriver configuration utility.Check Version:
No single command; check via Windows GUI or WinDriver's own utilities.Verify Fix Applied:
Verify installed WinDriver version is 12.7.0 or higher using the same methods.📡 Detection & Monitoring
Log Indicators:
- Windows Event Logs showing SYSTEM crashes (Event ID 41)
- Unexpected system reboots
- WinDriver service failures
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
EventID=41 AND Source="Microsoft-Windows-Kernel-Power" | search "BugCheckCode" OR "blue screen"🔗 References
- https://jungo.com/windriver/versions/
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
- https://jungo.com/windriver/versions/
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-04
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-001_en.pdf
