PT-2023-1355 · Mitsubishi · Melfa Sd/Sq Series+1

Published 2023-01-26 · Updated 2023-07-21 · CVE-2022-33323

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series (affected versions not specified)

Description The issue concerns a remote unauthenticated attacker gaining unauthorized access through an unauthorized telnet login by bypassing authentication. This is related to insufficient protection of service data when implementing debug code in the robot controller's firmware. The vulnerability allows a remote attacker to bypass security restrictions and gain unauthorized access to protected information using the TELNET network protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-489

Related Identifiers

BDU:2023-00671

CVE-2022-33323

Affected Products

Melfa Fr Series

Melfa Sd/Sq Series

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-33323 · Security Note
• https://bdu.fstec.ru/vul/2023-00671 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-020_en.pdf · Vendor Advisory
• https://t.me/cibsecurity/57377 · Telegram Post
• https://t.me/cvenotify/43422 · Telegram Post
• https://jvn.jp/vu/JVNVU94588481/index.html · Note
• https://cisa.gov/uscert/ics/advisories/icsa-23-026-05 · Note