Information disclosure, tampering, deletion and destruction vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules

CVE-2023-2063

Summary

A vulnerability has been identified in the FTP function of Mitsubishi Electric's EtherNet/IP modules, specifically the MELSEC iQ-R Series RJ71EIP91 and MELSEC iQ-F Series FX5-ENET/IP. This issue enables a remote unauthenticated attacker to upload files of potentially harmful types, leading to severe consequences including unauthorized information disclosure, data manipulation, and even the deletion or destruction of critical files. The nature of this vulnerability poses significant risks, as it can be exploited to facilitate additional malicious activities.

References