CVE-2023-4699 Missing authorization in MELSEC L Series LD77MS16
Remote unauthenticated attackers can execute arbitrary commands on Mitsubishi PLCs and CNCs, leading to data theft, modification, or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-4699?
CVE-2023-4699 is a critical missing authorization vulnerability in Mitsubishi Electric Corporation MELSEC L Series LD77MS16, published on 6 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi Electric CNC M800V/M80V series, Mitsubishi Electric CNC M800/M80/E80 series and Mitsubishi Electric CNC M700V/M70V/E70 series allows a remote unauthenticated attacker to execute arbitrary commands by sending specific packets to the affected products. This could lead to disclose or tamper with information by reading or writing control programs, or cause a denial-of-service (DoS) condition on the products by resetting the memory contents of the products to factory settings or resetting the products remotely.
Which versions are affected by CVE-2023-4699?
It affects 216 products.
Products include Mitsubishielectric Fx3g-14mr\/Ds Firmware, Mitsubishielectric Fx3g-14mr\/Es-a Firmware, Mitsubishielectric Fx3g-14mr\/Es Firmware, Mitsubishielectric Fx3g-14mt\/Ds Firmware, Mitsubishielectric Fx3g-14mt\/Dss Firmware, Mitsubishielectric Fx3g-14mt\/Es-a Firmware and 210 more.
How do I fix CVE-2023-4699?
No fix has been published for CVE-2023-4699 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-4699 being exploited?
There is no known exploitation of CVE-2023-4699 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Mitsubishi Electric Corporation MELSEC L Series LD77MS16
Sources
Also known as GHSA-q8jx-8wr3-gv52.