Critical severity · published Nov 6, 2023
CVE-2023-4699
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules,…
9.1
CVSS
0.8%
EPSS
No
On KEV
Description
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi Electric CNC M800V/M80V series, Mitsubishi Electric CNC M800/M80/E80 series and Mitsubishi Electric CNC M700V/M70V/E70 series allows a remote unauthenticated attacker to execute arbitrary commands by sending specific packets to the affected products. This could lead to disclose or tamper with information by reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memory contents of the products to factory settings or resetting the products remotely.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FF
Fx3u-128mr/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-128mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-128mr/es-a Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-128mt/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-128mt/dss Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-128mt/e Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-128mt/es-a Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-128mt/ess Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-16mr/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-16mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-16mr/es-a Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
FF
Fx3u-16mt/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD