CVE-2023-2061: Authentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP Modules
First published: Fri Jun 02 2023(Updated: )
Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP.
Credit: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mitsubishielectric Fx5-enet\/ip Firmware | ||
| Mitsubishielectric Fx5-enet\/ip | ||
| Mitsubishielectric Sw1dnn-eipct-bd Firmware | ||
| Mitsubishielectric Sw1dnn-eipct-bd | ||
| Mitsubishielectric Rj71eip91 Firmware | ||
| Mitsubishielectric Rj71eip91 | ||
| Mitsubishielectric Sw1dnn-eipctfx5-bd Firmware | ||
| Mitsubishielectric Sw1dnn-eipctfx5-bd |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-2061?
CVE-2023-2061 is a vulnerability in the FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP.
How does CVE-2023-2061 affect Mitsubishi Electric Corporation?
CVE-2023-2061 allows a remote unauthenticated attacker to obtain a hard-coded password and access the module via FTP on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP.
What is the severity of CVE-2023-2061?
CVE-2023-2061 has a severity score of 7.5 (high).
How can I fix CVE-2023-2061?
To fix CVE-2023-2061, it is recommended to update the firmware of Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP.
Where can I find more information about CVE-2023-2061?
More information about CVE-2023-2061 can be found on the Mitsubishi Electric Corporation PSIRT website and the Japan Vulnerability Notes (JVN) website.
- collector/nvd-latest
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/severity
- agent/author
- agent/event
- agent/description
- agent/tags
- agent/first-publish-date
- vendor/mitsubishielectric
- canonical/mitsubishielectric fx5-enet\/ip firmware
- canonical/mitsubishielectric fx5-enet\/ip
- canonical/mitsubishielectric sw1dnn-eipct-bd firmware
- canonical/mitsubishielectric sw1dnn-eipct-bd
- canonical/mitsubishielectric rj71eip91 firmware
- canonical/mitsubishielectric rj71eip91
- canonical/mitsubishielectric sw1dnn-eipctfx5-bd firmware
- canonical/mitsubishielectric sw1dnn-eipctfx5-bd