Vulnerability · Published Feb 13, 2024 · Assigned by Mitsubishi
CVE-2023-6815
Medium 6.5
In plain English
A medium-severity security flaw in MELSEC iQ-R Series Safety CPU R08SFCPU from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.
Affected products (as reported)
Weakness: CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf vendor-advisory
- https://jvn.jp/vu/JVNVU95085830/index.html government-resource
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01 government-resource