Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-4699— Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products

Quick assessment

Affected
Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MT/ES
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mitsubishi Electric MELSEC iQ-F series和Mitsubishi Electric MELSEC-F Series都是日本三菱电机（Mitsubishi Electric）公司的产品。Mitsubishi Electric MELSEC iQ-F series是一款可编程逻辑控制器。Mitsubishi Electric MELSEC-F Series是工控设备具有模拟和通信功能可扩展性的基本微型 PLC。 Mitsubishi Electric MELSEC-F Ser

CVSS 10.0 · Critical EPSS 0.75% · P53
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-4699

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi Electric CNC M800V/M80V series, Mitsubishi Electric CNC M800/M80/E80 series and Mitsubishi Electric CNC M700V/M70V/E70 series allows a remote unauthenticated attacker to execute arbitrary commands by sending specific packets to the affected products. This could lead to disclose or tamper with information by reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memory contents of the products to factory settings or resetting the products remotely.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Mitsubishi Electric Corporation MELSEC-F Series和MELSEC iQ-F Series 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mitsubishi Electric MELSEC iQ-F series和Mitsubishi Electric MELSEC-F Series都是日本三菱电机（Mitsubishi Electric）公司的产品。Mitsubishi Electric MELSEC iQ-F series是一款可编程逻辑控制器。Mitsubishi Electric MELSEC-F Series是工控设备具有模拟和通信功能可扩展性的基本微型 PLC。 Mitsubishi Electric MELSEC-F Ser
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MT/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-32MT/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-48MT/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-64MT/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-80MT/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-128MT/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MR/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-32MR/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-48MR/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-64MR/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-80MR/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-128MR/ES all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MT/ESS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-32MT/ESS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-48MT/ESS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-64MT/ESS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-80MT/ESS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-128MT/ESS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MT/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-32MT/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-48MT/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-64MT/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-80MT/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-128MT/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-16MR/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-32MR/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-48MR/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-64MR/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-80MR/DS all versions -
Mitsubishi Electric Corporation MELSEC-F Series FX3U-128MR/DS all versions -

II. Public POCs for CVE-2023-4699

# POC Description Source Link Shenlong Link
1 This code functionally approximates the Citrix Bleed vulnerability (CVE-2023-4699). https://github.com/Scottzxor/Citrix-Bleed-Buffer-Overread-Demo POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-4699

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-4699 (2)

Other References for CVE-2023-4699 (1)

IV. Related Vulnerabilities

Same product: MELSEC-F Series FX3U-16MT/ES
Same vendor: Mitsubishi Electric Corporation
Same weakness: CWE-306

V. Comments for CVE-2023-4699

No comments yet

Leave a comment