CVE-2023-3346 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series
Remote unauthenticated attackers can cause denial of service and execute arbitrary code on Mitsubishi CNC systems via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3346?
CVE-2023-3346 is a critical memory corruption vulnerability in MITSUBISHI CNC C80 Series C80, published on 3 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.
Weakness: CWE-120
Which versions are affected by CVE-2023-3346?
It affects 21 products.
Products include Mitsubishielectric C80 Firmware, Mitsubishielectric E70 Firmware, Mitsubishielectric E80 Firmware, Mitsubishielectric M70v Firmware, Mitsubishielectric M720vs 15-Type Firmware, Mitsubishielectric M720vs Firmware and 15 more.
How do I fix CVE-2023-3346?
No fix has been published for CVE-2023-3346 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-3346 being exploited?
There is no known exploitation of CVE-2023-3346 in the wild and no public exploit code.
Sources
Also known as GHSA-whh9-m2fc-3q2v.