CVE-2023-1618

Katalog CVE

CVSS 8.6 · High EPSS 1,1%

Kerentanan Active Debug Code pada mitsubishielectric melsec ws0-geth00200 firmware. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unauthorized login can reset the module, and if certain conditions are met, he/she can disclose or tamper with the module's configuration or rewrite the firmware.

Rincian

Terbit di NVD

19 Mei 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-489: Active Debug Code
CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-002_en.pdf advisory vendor
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-02 mitigasi · advisory pihak ketiga · pemerintah AS
• https://jvn.jp/vu/JVNVU96063959 advisory pihak ketiga