A critical remote code execution vulnerability in Mitsubishi Electric smartRTU allows unauthenticated attackers to gain full control over the device, posing a severe risk to industrial operations.

This is a command injection vulnerability (CWE-78) where an unauthenticated attacker can execute arbitrary OS commands on the device. The lack of authentication allows for remote, unauthenticated exploitation.

With a CVSS score of 9.8, this vulnerability poses an extreme risk to critical infrastructure. Successful exploitation allows for complete device takeover, enabling attackers to disrupt industrial processes, destroy data, or manipulate monitoring information, leading to potential safety and operational hazards.

Immediate Action: Update Mitsubishi Electric smartRTU to a version beyond 3.37 as specified by the vendor's security advisory.

Proactive Monitoring: Monitor industrial network traffic for suspicious command execution patterns or anomalous outbound connections originating from the smartRTU devices.

Compensating Controls: Isolate smartRTU devices within a secure, segmented industrial control network (ICS/OT) and restrict access to authorized management workstations only.

Public Exploit Available: Unknown

Given the target environment—industrial control systems—this vulnerability must be addressed immediately. Organizations should verify their firmware versions and apply the vendor-supplied update, while simultaneously ensuring that these devices are not directly exposed to the internet.