CVE-2023-2846: Authentication Bypass Vulnerability in MELSEC-F Series main module

Reference Links

• https://jvn.jp/vu/JVNVU94519952
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-04 (Advisory)
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-005_en.pdf

Parent vulnerabilities

(Appears in the following advisories)

• ICSA-23-180-04

Frequently Asked Questions

• What is the severity of CVE-2023-2846?

  CVE-2023-2846 has been rated as critical due to its potential for an unauthenticated remote attacker to exploit the vulnerability.

• How do I fix CVE-2023-2846?

  To resolve CVE-2023-2846, users should install the latest firmware updates provided by Mitsubishi Electric for affected devices.

• What are the affected products for CVE-2023-2846?

  CVE-2023-2846 impacts various Mitsubishi Electric MELSEC iQ-F Series main modules, including multiple models of the FX3U, FX3MT, FX3UC, and related firmware versions.

• Can CVE-2023-2846 be exploited remotely?

  Yes, CVE-2023-2846 allows an unauthenticated remote attacker to exploit the vulnerability by sending crafted packets.

• What is the nature of the CVE-2023-2846 vulnerability?

  CVE-2023-2846 is an authentication bypass by capture-replay vulnerability that allows unauthorized access to settings and login.