CVE-2023-0457 Information Disclosure Vulnerability in MELSEC Series

High 7.5 Published 3 Mar 2023 Updated 5 Mar 2025

Remote attackers can read plaintext credentials from project files to access FTP or Web servers on Mitsubishi MELSEC PLCs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-0457?

CVE-2023-0457 is a high-severity vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET, published on 3 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.

Weakness: CWE-522, CWE-256

Which versions are affected by CVE-2023-0457?

It affects 38 products.

Products include Mitsubishielectric Fx5-Enet\/Ip Firmware, Mitsubishielectric Fx5-Enet Firmware, Mitsubishielectric Fx5s-30mr\/Es Firmware, Mitsubishielectric Fx5s-30mt\/Es Firmware, Mitsubishielectric Fx5s-30mt\/Ess Firmware, Mitsubishielectric Fx5s-40mr\/Es Firmware and 32 more.

How do I fix CVE-2023-0457?

No fix has been published for CVE-2023-0457 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-0457 being exploited?

There is no known exploitation of CVE-2023-0457 in the wild and no public exploit code.

Sources

Also known as GHSA-wmp3-7qc8-4x9f.