CVE-2023-142410.0CriticalCWE-120

CVE-2023-1424: Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module

Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ES

Affected: Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-32MT/ES · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

3.4%probability of exploitation in the next 30 days

89th percentile

050100

Higher than 89% of scored CVEs

10.0CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSEC iQ-R Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution.

Affected products20

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ESSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/ESSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/ESSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MR/ESSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MR/ESSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MR/ESSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/DSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/DSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/DSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MR/DSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MR/DSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MR/DSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ESSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/ESSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/ESSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/DSSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-64MT/DSSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-80MT/DSSSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-32MT/DSerial number 17X**** or later, versions from 1.220 to 1.281
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5UC-64MT/DSerial number 17X**** or later, versions from 1.220 to 1.281

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Classic Buffer Overflow · Memory Corruption
Vendor: Mitsubishi Electric Corporation
Published: May 2023
Band: Possible (1 to 10%), May 2023

CoverageNo articles yet

No CyberSIXT article names CVE-2023-1424 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.