Vulnerabilities > CVE-2023-6815 - Unspecified vulnerability in Mitsubishielectric products
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.
Vulnerable Configurations
References
- https://jvn.jp/vu/JVNVU95085830/index.html
- https://jvn.jp/vu/JVNVU95085830/index.html
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf