CVE-2023-4562— Information Disclosure, Information Tampering and Authentication Bypass Vulnerability in MELSEC-F Series main module

Quick assessment

Copy summary Copy citation

Affected

Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MT/ES

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mitsubishi Electric MELSEC-F Series是日本三菱电机（Mitsubishi Electric）公司的工控设备具有模拟和通信功能可扩展性的基本微型 PLC。 Mitsubishi Electric MELSEC-F Series 存在安全漏洞，该漏洞源于主模块存在身份验证错误漏洞。攻击者可利用该漏洞通过发送非法消息，从产品中获取序列程序或写入恶意程序。

CVE-2023-4562 affects Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MT/ES. No confirmed in-the-wild exploitation; assess based on exposure. Mitsubishi Electric MELSEC-F Series是日本三菱电机（Mitsubishi Electric）公司的工控设备具有模拟和通信功能可扩展性的基本微型 PLC。 Mitsubishi Electric MELSEC-F Series 存在安全漏洞，该漏洞源于主模块存在身份验证错误漏洞。攻击者可利用该漏洞通过发送非法消息，从产品中获取 CVE-2023-4562 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2023-4562

I. Basic Information for CVE-2023-4562

Affected Products

II. Public POCs for CVE-2023-4562

III. Intelligence Information for CVE-2023-4562

Vendor Advisories for CVE-2023-4562 (2)

• https://www.cisa.gov/news-events/ics-advisories/icsa-23-285-13 government-resource
• https://jvn.jp/vu/JVNVU90509290/ government-resource

Other References for CVE-2023-4562 (1)

• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-012_en.pdf vendor-advisory

• https://www.cve.org/CVERecord?id=CVE-2023-4562

IV. Related Vulnerabilities

V. Comments for CVE-2023-4562