Log in Start free

Vulnerability · Published May 24, 2023 · Assigned by Mitsubishi

CVE-2023-1424Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module

Critical 10.0

In plain English

A critical-severity buffer overflow in MELSEC iQ-F Series FX5U-32MR/DS from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)3.4%top 11.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSEC iQ-R Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ES Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-64MT/ES Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-80MT/ES Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MR/ES Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-64MR/ES Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-80MR/ES Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/DS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-64MT/DS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-80MT/DS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MR/DS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-64MR/DS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-80MR/DS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ESS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-64MT/ESS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-80MT/ESS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/DSS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-64MT/DSS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-80MT/DSS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/D Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-64MT/D Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-96MT/D Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-64MT/DSS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-96MT/DSS Serial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MR/DS-TS versions from 1.220 to 1.281
Mitsubishi Electric Corporation MELSEC iQ-R Series R00CPU versions 35 and prior
Mitsubishi Electric Corporation MELSEC iQ-R Series R01CPU versions 35 and prior
Mitsubishi Electric Corporation MELSEC iQ-R Series R02CPU versions 35 and prior

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References