JTEKT HMI ViewJet C-more and GC-A2 Series Unintended Proxy Vulnerability

A 'Confused Deputy' vulnerability has been identified in JTEKT HMI ViewJet C-more series and HMI GC-A2 series. This vulnerability allows a remote, unauthenticated attacker to exploit the product as an intermediary in an FTP bounce attack.

Impact

Exploitation of this vulnerability could be used in an FTP bounce attack, with the HMI acting as a relay to target another host.

Remediation

JTEKT has ended support for these products. Users are advised to apply the recommended workaround, which includes using a firewall or VPN to prevent unauthorized access and limiting accessibility to internal networks.