CVE-2023-2060: Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules
Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to access to the module via FTP by dictionary attack or password sniffing.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-2060?
CVE-2023-2060 is a Weak Password Requirements vulnerability in the FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP.
How does CVE-2023-2060 affect Mitsubishi Electric Corporation products?
CVE-2023-2060 allows a remote unauthenticated attacker to access the module via FTP by dictionary attack or password guessing.
What is the severity of CVE-2023-2060?
The severity of CVE-2023-2060 is high, with a CVSS score of 7.5.
Which Mitsubishi Electric Corporation products are affected by CVE-2023-2060?
CVE-2023-2060 affects the MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP.
How can the Weak Password Requirements vulnerability in the FTP function be fixed?
To fix the Weak Password Requirements vulnerability in the FTP function, it is recommended to update to the latest firmware version provided by Mitsubishi Electric Corporation.