CVE-2023-2846 Authentication Bypass Vulnerability in MELSEC-F Series main module
Remote attackers can bypass authentication and log in to Mitsubishi MELSEC-F PLCs by replaying captured packets, compromising industrial control systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2846?
CVE-2023-2846 is a high-severity authentication bypass vulnerability in Mitsubishi Electric Corporation MELSEC-F Series FX3G-14MR/DS, published on 30 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets.
Weakness: CWE-294
Which versions are affected by CVE-2023-2846?
It affects 150 products.
Products include Mitsubishielectric Fx3g-14mr\/Ds Firmware, Mitsubishielectric Fx3g-14mr\/Es-a Firmware, Mitsubishielectric Fx3g-14mr\/Es Firmware, Mitsubishielectric Fx3g-14mt\/Ds Firmware, Mitsubishielectric Fx3g-14mt\/Dss Firmware, Mitsubishielectric Fx3g-14mt\/Es-a Firmware and 144 more.
How do I fix CVE-2023-2846?
No fix has been published for CVE-2023-2846 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-2846 being exploited?
There is no known exploitation of CVE-2023-2846 in the wild and no public exploit code.
Other vulnerabilities in Mitsubishi Electric Corporation MELSEC-F Series FX3G-14MR/DS
Sources
Also known as GHSA-f86h-3pcp-x4mw.