Log in Start free

Vulnerability · Published Jun 2, 2023 · Assigned by Mitsubishi

CVE-2023-2060Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules

High 7.5

In plain English

A high-severity security flaw in MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.8%top 42.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module via FTP by dictionary attack or password sniffing.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 all versions
Mitsubishi Electric Corporation MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP all versions

Weakness: CWE-521 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References