Medium severity · published Nov 6, 2023
CVE-2023-4625
Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote…
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fx5s-30mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5s-30mt/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5s-30mt/ess Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5s-40mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5s-40mt/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5s-60mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5s-60mt/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5s-80mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5s-80mt/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5u-32mr/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5u-32mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx5u-32mt/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
Affected product
FF
Fx5s-30mr/es Firmware
Mitsubishielectric
More from Fx5s-30mr/es Firmware
9.1
CVE-2022-40267
Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with…
7.5
CVE-2023-0457
Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote…