Vulnerability · Published Nov 21, 2023 · Assigned by Mitsubishi
CVE-2023-5274
Low 2.5
In plain English
A low-severity improper input validation in GX Works2 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)2.5Low
Exploit odds (30 days)0.3%top 80.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by sending specially crafted packets. However, the attacker would need to send the packets from within the same personal computer where the function is running.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mitsubishi Electric Corporation | GX Works2 | all versions |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-015_en.pdf vendor-advisory
- https://jvn.jp/vu/JVNVU98760962/index.html government-resource
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-331-03 government-resource