Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules
CVE-2023-2061

6.2MEDIUM

Key Information:

Vendor
Mitsubishi Electric Corporation
Status
Melsec Iq-r Series Ethernet/ip Module Rj71eip91
Melsec Iq-f Series Ethernet/ip Module Fx5-enet/ip
Vendor
CVE Published:
2 June 2023

Summary

The vulnerability involves a hard-coded password within the FTP function of specific Ethernet/IP modules from Mitsubishi Electric. This security flaw allows unauthorized remote attackers to exploit the system by gaining access via FTP, thereby exposing the server to potential malicious activities. It is crucial for users of the MELSEC iQ-R and iQ-F Series EtherNet/IP modules to address this vulnerability promptly by following best practices for network security and implementing available patches.

Affected Version(s)

MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP all versions

MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 all versions

References

https://www.mitsubishielectric.co.jp/psirt/vulnerability/...
https://jvn.jp/vu/JVNVU92908006

CVSS V3.1

Score:
6.2
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.