Critical severity · published Aug 3, 2023
CVE-2023-3346
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service…
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
C80 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
EF
E70 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
EF
E80 Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MF
M70v Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
M1
M720vs 15-type Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MF
M720vs Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MF
M720vw Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
M1
M730vs 15-type Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MF
M730vs Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MF
M730vw Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
M1
M750vs 15-type Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MF
M750vs Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3346
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3346
Third Party Advisory
https://jvn.jp/vu/JVNVU90352157/index.html
Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-03
Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf
