Vulnerability · Published Nov 19, 2024 · Assigned by Mitsubishi

CVE-2024-8403Denial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP Module

High 7.5

In plain English

A high-severity security flaw in MELSEC iQ-F Series FX5-ENET from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.7%top 47.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Validation of Specified Type of Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET versions 1.100 to 1.200 and FX5-ENET/IP versions 1.100 to 1.104 allows a remote attacker to cause a Denial of Service condition in Ethernet communication of the products by sending specially crafted SLMP packets.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5-ENET	1.100 to 1.200
Mitsubishi Electric Corporation	MELSEC iQ-F Series FX5-ENET/IP	1.100 to 1.104

Weakness: CWE-1287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-009_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU97790713/ government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-324-01 government-resource