CVE-2023-4699

Katalog CVE

CVSS 9.1 · Critical EPSS 0,75%

Kerentanan Missing Authentication for Critical Function pada mitsubishielectric fx3u-32mt/es firmware, mitsubishielectric fx3u-48mt/es firmware +58 lainnya. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi Electric CNC M800V/M80V series, Mitsubishi Electric CNC M800/M80/E80 series and Mitsubishi Electric CNC M700V/M70V/E70 series allows a remote unauthenticated attacker to execute arbitrary commands by sending specific packets to the affected products. This could lead to disclose or tamper with information by reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memory contents of the products to factory settings or resetting the products remotely.

Rincian

Terbit di NVD

6 November 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,75% peluang dieksploitasi; lebih tinggi dari 53,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 216 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-013_en.pdf advisory vendor
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-03 advisory pihak ketiga · pemerintah AS
• https://jvn.jp/vu/JVNVU94620134/ advisory pihak ketiga