CVE-2023-2060: Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules
First published: Fri Jun 02 2023(Updated: )
Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module via FTP by dictionary attack or password sniffing.
Credit: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mitsubishielectric Fx5-enet\/ip Firmware | ||
| Mitsubishielectric Fx5-enet\/ip | ||
| Mitsubishielectric Sw1dnn-eipct-bd Firmware | ||
| Mitsubishielectric Sw1dnn-eipct-bd | ||
| Mitsubishielectric Rj71eip91 Firmware | ||
| Mitsubishielectric Rj71eip91 | ||
| Mitsubishielectric Sw1dnn-eipctfx5-bd Firmware | ||
| Mitsubishielectric Sw1dnn-eipctfx5-bd |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-2060?
CVE-2023-2060 is a Weak Password Requirements vulnerability in the FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP.
How does CVE-2023-2060 affect Mitsubishi Electric Corporation products?
CVE-2023-2060 allows a remote unauthenticated attacker to access the module via FTP by dictionary attack or password guessing.
What is the severity of CVE-2023-2060?
The severity of CVE-2023-2060 is high, with a CVSS score of 7.5.
Which Mitsubishi Electric Corporation products are affected by CVE-2023-2060?
CVE-2023-2060 affects the MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP.
How can the Weak Password Requirements vulnerability in the FTP function be fixed?
To fix the Weak Password Requirements vulnerability in the FTP function, it is recommended to update to the latest firmware version provided by Mitsubishi Electric Corporation.
- collector/nvd-latest
- collector/nvd-index
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/weakness
- agent/author
- agent/event
- agent/description
- agent/tags
- agent/first-publish-date
- vendor/mitsubishielectric
- canonical/mitsubishielectric fx5-enet\/ip firmware
- canonical/mitsubishielectric fx5-enet\/ip
- canonical/mitsubishielectric sw1dnn-eipct-bd firmware
- canonical/mitsubishielectric sw1dnn-eipct-bd
- canonical/mitsubishielectric rj71eip91 firmware
- canonical/mitsubishielectric rj71eip91
- canonical/mitsubishielectric sw1dnn-eipctfx5-bd firmware
- canonical/mitsubishielectric sw1dnn-eipctfx5-bd