PT-2023-3413 · Mitsubishi · Melsec Iq-F Series

Chun Liu + 4 · Published 2023-06-29 · Updated 2023-07-10 · CVE-2023-2846

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions MELSEC iQ-F Series versions FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA

Description The issue is related to an authentication bypass vulnerability using a capture-replay attack on intercepted parameters. This could allow a remote attacker to bypass security restrictions and reset login settings by sending specially crafted packets. The vulnerability affects the Ethernet modules FX3U-ENET-ADP and FX3U-ENET(-L) of the MELSEC iQ-F Series programmable logic controllers.

Recommendations For MELSEC iQ-F Series versions FX3U, FX3UC, FX3G, FX3GC-32MT, FX3GE, FX3GA, FX3S, and FX3SA, consider disabling the Ethernet modules FX3U-ENET-ADP and FX3U-ENET(-L) as a temporary workaround until a patch is available. Restrict access to the affected modules to minimize the risk of exploitation. Avoid using the affected products for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-294

Related Identifiers

BDU:2023-03590

CVE-2023-2846

Affected Products

Melsec Iq-F Series

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-2846 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-005_en.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03590 · Security Note
• https://vuldb.com/ru/?id.232718 · Note
• https://t.me/cibsecurity/65772 · Telegram Post
• https://jvn.jp/vu/JVNVU94519952 · Note
• https://t.me/cvenotify/53984 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023063021 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-180-04 · Note