Vulnerability · Published Jan 30, 2024 · Assigned by Mitsubishi

CVE-2023-6374

Medium 5.9

In plain English

A medium-severity security flaw in MELSEC WS Series WS0-GETH00200 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.8%top 44.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	MELSEC WS Series WS0-GETH00200	All serial numbers

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf vendor-advisory
https://jvn.jp/vu/JVNVU99497477 government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03 government-resource