CVE-2023-3346

high-risk
Published 2023-08-03

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.

Do I need to act?

~
1.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (20)

C80 Firmware
E70 Firmware
E80 Firmware
M70V Firmware
M720Vs Firmware
M720Vs 15-Type Firmware
M720Vw Firmware
M730Vs Firmware
M730Vs 15-Type Firmware
M730Vw Firmware
M750Vs Firmware
M750Vs 15-Type Firmware
M750Vw Firmware
M80 Firmware
M800S Firmware
M800Vs Firmware
M800Vw Firmware
M800W Firmware
M80V Firmware
M80Vw Firmware

Affected Vendors

Mitsubishielectric

References (6)

Third Party Advisory https://jvn.jp/vu/JVNVU90352157/index.html
Third Party Advisory https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-03
Vendor Advisory https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf
Third Party Advisory https://jvn.jp/vu/JVNVU90352157/index.html
Third Party Advisory https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-03
Vendor Advisory https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf
55
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 3/34 · Minimal
Exposure 20/34 · Moderate