CVE-2023-2846

high-risk
Published 2023-06-30

Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets.

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Fx3U-16Mr\/Es Firmware
Fx3U-16Mt\/Es Firmware
Fx3U-16Mt\/Ess Firmware
Fx3U-32Mr\/Es Firmware
Fx3U-32Mt\/Es Firmware
Fx3U-32Mt\/Ess Firmware
Fx3U-48Mr\/Es Firmware
Fx3U-48Mt\/Es Firmware
Fx3U-48Mt\/Ess Firmware
Fx3U-64Mr\/Es Firmware
Fx3U-64Mt\/Es Firmware
Fx3U-64Mt\/Ess Firmware
Fx3U-80Mr\/Es Firmware
Fx3U-80Mt\/Es Firmware
Fx3U-80Mt\/Ess Firmware
Fx3U-128Mr\/Es Firmware
Fx3U-128Mt\/Es Firmware
Fx3U-128Mt\/Ess Firmware
Fx3U-16Mr\/Ds Firmware
Fx3U-16Mt\/Ds Firmware

Affected Vendors

Mitsubishielectric

References (6)

Mitigation https://jvn.jp/vu/JVNVU94519952
Mitigation https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-04
Mitigation https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-005_en.pdf
Mitigation https://jvn.jp/vu/JVNVU94519952
Mitigation https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-04
Mitigation https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-005_en.pdf
59
/ 100
high-risk
Severity 26/34 · High
Exploitability 0/34 · Minimal
Exposure 33/34 · Critical