by Kastro
Paper/Archive/CVE-2023-4562

CVE-2023-4562

Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MT/ES — Information Disclosure, Information Tampering and Authentication Bypass Vulnerability in MELSEC-F Series main module

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 68.5.685 × 2013.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequence programs from the product or write malicious sequence programs or improper data in the product without authentication by sending illegitimate messages.

Affected

ProductAffectedFixed inSource
MELSEC-F Series FX3U-16MT/ESall versions–CNA
MELSEC-F Series FX3U-32MT/ESall versions–CNA
MELSEC-F Series FX3U-48MT/ESall versions–CNA
MELSEC-F Series FX3U-64MT/ESall versions–CNA
MELSEC-F Series FX3U-80MT/ESall versions–CNA
MELSEC-F Series FX3U-128MT/ESall versions–CNA
MELSEC-F Series FX3U-16MR/ESall versions–CNA
MELSEC-F Series FX3U-32MR/ESall versions–CNA
MELSEC-F Series FX3U-48MR/ESall versions–CNA
MELSEC-F Series FX3U-64MR/ESall versions–CNA
MELSEC-F Series FX3U-80MR/ESall versions–CNA
MELSEC-F Series FX3U-128MR/ESall versions–CNA

Scores by source

Mitsubishi (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorymitsubishielectric.com/en/psirt/vulnerability/pdf/2023-012_en.pdfrefjvn.jp/vu/JVNVU90509290refcisa.gov/news-events/ics-advisories/icsa-23-285-13