CVE-2023-6815 Information disclosure in MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU

Medium 6.5 Published 13 Feb 2024 Updated 2 Aug 2024

Remote authenticated attackers can disclose lower-level user credentials by sending crafted packets to Mitsubishi MELSEC iQ-R Safety and Process CPUs.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-6815?

CVE-2023-6815 is a medium-severity vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU, published on 13 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.

Weakness: CWE-266

Which versions are affected by CVE-2023-6815?

It affects 8 products.

Products include Mitsubishielectric R08psfcpu Firmware, Mitsubishielectric R08sfcpu Firmware, Mitsubishielectric R120psfcpu Firmware, Mitsubishielectric R120sfcpu Firmware, Mitsubishielectric R16psfcpu Firmware, Mitsubishielectric R16sfcpu Firmware and 2 more.

How do I fix CVE-2023-6815?

No fix has been published for CVE-2023-6815 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-6815 being exploited?

There is no known exploitation of CVE-2023-6815 in the wild and no public exploit code.

Sources

Also known as GHSA-r5w8-hf4h-f29v.