Vulnerability · Published Nov 6, 2023 · Assigned by Mitsubishi

CVE-2023-4625Denial-of-Service（DoS） Vulnerability in Web server function on MELSEC Series CPU module

Medium 5.3

In plain English

A medium-severity security flaw in MELSEC iQ-F Series FX5S-30MR/ES from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.3%top 28.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-32MT/ES	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-64MT/ES	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-80MT/ES	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-32MR/ES	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-64MR/ES	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-80MR/ES	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-32MT/DS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-64MT/DS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-80MT/DS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-32MR/DS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-64MR/DS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-80MR/DS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-32MT/ESS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-64MT/ESS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-80MT/ESS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-32MT/DSS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-64MT/DSS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5U-80MT/DSS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-32MT/D	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-64MT/D	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-96MT/D	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-32MT/DSS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-64MT/DSS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-96MT/DSS	all versions (for serial number 17X** and later)1.060 or later (for serial number 179** and prior)
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-32MT/DS-TS	all versions
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-32MT/DSS-TS	all versions
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UC-32MR/DS-TS	all versions
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UJ-24MT/ES	all versions
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UJ-40MT/ES	all versions
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5UJ-60MT/ES	all versions

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU94620134 government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02 government-resource