PT-2023-3942 · Mitsubishi · Mitsubishi Cnc Series

01Dgu0 · Published 2023-07-27 · Updated 2023-08-11 · CVE-2023-3346

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MITSUBSHI CNC Series (affected versions not specified)

Description The issue is related to a Buffer Copy without Checking Size of Input, also known as a 'Classic Buffer Overflow'. This allows a remote unauthenticated attacker to cause a Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. System reset is required for recovery.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2023-04237

CVE-2023-3346

Affected Products

Mitsubishi Cnc Series

References · 8

• https://bdu.fstec.ru/vul/2023-04237 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-3346 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf · Vendor Advisory
• https://vuldb.com/ru/?id.235590 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-23-208-03 · Note
• https://t.me/cvenotify/55678 · Telegram Post
• https://t.me/cibsecurity/67632 · Telegram Post
• https://jvn.jp/vu/JVNVU90352157/index.html · Note