CRITICAL🇵🇱 Wersja polska

CVE-2023-3346

CVSS 9.8v3.1pub. 2023-08-03upd. 2024-11-21

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.

🇵🇱 Read Polish description →

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitsubishielectric C80
HW
Mitsubishielectric
all versions
Mitsubishielectric C80 Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric E70
HW
Mitsubishielectric
all versions
Mitsubishielectric E70 Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric E80
HW
Mitsubishielectric
all versions
Mitsubishielectric E80 Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M70v
HW
Mitsubishielectric
all versions
Mitsubishielectric M70v Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M720vs
HW
Mitsubishielectric
all versions
Mitsubishielectric M720vs 15 Type
HW
Mitsubishielectric
all versions
Mitsubishielectric M720vs 15 Type Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M720vs Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M720vw
HW
Mitsubishielectric
all versions
Mitsubishielectric M720vw Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M730vs
HW
Mitsubishielectric
all versions
Mitsubishielectric M730vs 15 Type
HW
Mitsubishielectric
all versions
Mitsubishielectric M730vs 15 Type Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M730vs Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M730vw
HW
Mitsubishielectric
all versions
Mitsubishielectric M730vw Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M750vs
HW
Mitsubishielectric
all versions
Mitsubishielectric M750vs 15 Type
HW
Mitsubishielectric
all versions
Mitsubishielectric M750vs 15 Type Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M750vs Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M750vw
HW
Mitsubishielectric
all versions
Mitsubishielectric M750vw Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M80
HW
Mitsubishielectric
all versions
Mitsubishielectric M800s
HW
Mitsubishielectric
all versions
Mitsubishielectric M800s Firmware
OS
Mitsubishielectric
all versions
Mitsubishielectric M800vs
HW
Mitsubishielectric
all versions

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

Tags

RCEAuth BypassDoSMemory

CWE

References

jvn.jp/vu/JVNVU90352157/index.html…

www.cisa.gov/news-events/ics-advisories/icsa-23-208-03…

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2…

jvn.jp/vu/JVNVU90352157/index.html…

www.cisa.gov/news-events/ics-advisories/icsa-23-208-03…

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2…

Related vulnerabilities

CVE-2023-6943CRITICAL9.8PL ✓same vendor

Unsafe Reflection w oprogramowaniu Mitsubishi Electric — zdalne wykonanie kodu

CVE-2023-4699CRITICAL10.0PL ✓same vendor

Brak uwierzytelnienia w sterownikach PLC i CNC Mitsubishi Electric — RCE

CVE-2023-4562CRITICAL9.1PL ✓same vendor

Pominięcie uwierzytelnienia w sterownikach PLC Mitsubishi MELSEC-F Series

CVE-2023-4088CRITICAL9.3PL ✓same vendor

Nieprawidłowe domyślne uprawnienia w oprogramowaniu Mitsubishi Electric GX Works3

CVE-2023-1424CRITICAL10.0PL ✓same vendor

Buffer overflow w Mitsubishi Electric MELSEC iQ-F/iQ-R — RCE i DoS bez uwierzytelnienia