PT-2023-2998 · Mitsubishi · Melsec Iq-F Series Ethernet/Ip Module Fx5-Enet/Ip+1

Published

2023-06-02

·

Updated

2024-11-14

·

CVE-2023-2060

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 (affected versions not specified) Mitsubishi Electric Corporation MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP (affected versions not specified)
Description The issue is related to weak password requirements in the FTP function of the affected modules, allowing a remote unauthenticated attacker to access the module via FTP by dictionary attack or password sniffing. This can enable the attacker to gain full access to the device.
Recommendations For Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91, consider disabling the FTP function until a patch is available. For Mitsubishi Electric Corporation MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP, consider disabling the FTP function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-521

Related Identifiers

BDU:2023-03028
CVE-2023-2060

Affected Products

Melsec Iq-F Series Ethernet/Ip Module Fx5-Enet/Ip
Melsec Iq-R Series Ethernet/Ip Module Rj71Eip91