CVE-2023-2062: Information Disclosure vulnerability in EtherNet/IP Configuration tools
First published: Fri Jun 02 2023(Updated: )
Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP. This vulnerability results in authentication bypass vulnerability, which allows the attacker to access MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP via FTP.
Credit: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mitsubishielectric Fx5-enet\/ip Firmware | ||
| Mitsubishielectric Fx5-enet\/ip | ||
| Mitsubishielectric Sw1dnn-eipct-bd Firmware | ||
| Mitsubishielectric Sw1dnn-eipct-bd | ||
| Mitsubishielectric Rj71eip91 Firmware | ||
| Mitsubishielectric Rj71eip91 | ||
| Mitsubishielectric Sw1dnn-eipctfx5-bd Firmware | ||
| Mitsubishielectric Sw1dnn-eipctfx5-bd | ||
| All of | ||
| Mitsubishielectric Fx5-enet\/ip Firmware | ||
| Mitsubishielectric Fx5-enet\/ip | ||
| All of | ||
| Mitsubishielectric Sw1dnn-eipct-bd Firmware | ||
| Mitsubishielectric Sw1dnn-eipct-bd | ||
| All of | ||
| Mitsubishielectric Rj71eip91 Firmware | ||
| Mitsubishielectric Rj71eip91 | ||
| All of | ||
| Mitsubishielectric Sw1dnn-eipctfx5-bd Firmware | ||
| Mitsubishielectric Sw1dnn-eipctfx5-bd |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of the Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools?
The vulnerability ID is CVE-2023-2062.
What is the severity of CVE-2023-2062?
The severity of CVE-2023-2062 is medium.
Which software is affected by CVE-2023-2062?
The affected software are Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD.
How does the Missing Password Field Masking vulnerability work?
The vulnerability allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP.
How to fix the Missing Password Field Masking vulnerability?
Apply the necessary patches or updates provided by Mitsubishi Electric Corporation.
- collector/nvd-latest
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/title
- agent/author
- agent/severity
- agent/first-publish-date
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/mitsubishielectric
- canonical/mitsubishielectric fx5-enet\/ip firmware
- canonical/mitsubishielectric fx5-enet\/ip
- canonical/mitsubishielectric sw1dnn-eipct-bd firmware
- canonical/mitsubishielectric sw1dnn-eipct-bd
- canonical/mitsubishielectric rj71eip91 firmware
- canonical/mitsubishielectric rj71eip91
- canonical/mitsubishielectric sw1dnn-eipctfx5-bd firmware
- canonical/mitsubishielectric sw1dnn-eipctfx5-bd