Authentication Bypass Vulnerability in MELSEC-F Series main module
CVE-2023-2846

7.5HIGH

Key Information:

Vendor
Mitsubishi Electric Corporation
Status
Melsec-f Series Fx3u-16mr/es
Melsec-f Series Fx3u-16mt/es
Melsec-f Series Fx3u-16mt/ess
Melsec-f Series Fx3u-32mr/es
Vendor
CVE Published:
30 June 2023

Summary

A vulnerability in the Mitsubishi Electric MELSEC iQ-F Series main modules allows potential attackers to bypass authentication mechanisms. By sending specially crafted packets, an unauthenticated individual can cancel password and keyword settings, effectively gaining unauthorized access to the affected devices.

Affected Version(s)

MELSEC-F Series FX3G-14MR/DS all versions

MELSEC-F Series FX3G-14MR/ES all versions

MELSEC-F Series FX3G-14MR/ES-A all versions

References

https://www.mitsubishielectric.com/en/psirt/vulnerability...
https://jvn.jp/vu/JVNVU94519952
https://www.cisa.gov/news-events/ics-advisories/icsa-23-1...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.