Rewterz Threat Advisory – ICS: Multiple Mitsubishi Electric MELSEC Series Vulnerabilities

Severity

High

Analysis Summary

CVE-2023-4699 CVSS:9.1

Mitsubishi Electric MELSEC Series is vulnerable to a denial of service, caused by insufficient verification of data authenticity. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2023-4625 CVSS:5.3

Mitsubishi Electric MELSEC iQ-F Series CPU Module is vulnerable to a denial of service, caused by a flaw in web server function. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.

Impact

• Denial of Service

Indicators Of Compromise

CVE

• CVE-2023-4699
• CVE-2023-4625

Affected Vendors

Mitsubishi Electric

Affected Products

• Mitsubishi Electric MELSEC-F series FX3U-xMy/z x=16 32 48 64 80 128 y=T R z=ES ESS DS DSS
• Mitsubishi Electric MELSEC-F series FX3U-32MR/UA1 FX3U-64MR/UA1
• Mitsubishi Electric MELSEC-F series FX3U-xMy/ES-A x=16 32 48 64 80 128 y=T R
• Mitsubishi Electric MELSEC-F series FX3UC-xMT/z x=16 32 64 96 z=D DSS
• Mitsubishi Electric MELSEC-F series FX3UC-16MR/D-T FX3UC-16MR/DS-T
• Mitsubishi Electric MELSEC-F series FX3UC-32MT-LT FX3UC-32MT-LT-2
• Mitsubishi Electric MELSEC-F series FX3UC-16MT/D-P4 FX3UC-16MT/DSS-P4
• Mitsubishi Electric MELSEC-F series FX3G-xMy/z x=14 24 40 60 y=T R z=ES ESS DS DSS
• Mitsubishi Electric MELSEC-F series FX3G-xMy/ES-A x=14 24 40 60 y=T R
• Mitsubishi Electric MELSEC-F series FX3GC-32MT/D FX3GC-32MT/DSS
• Mitsubishi Electric MELSEC-F series FX3GE-xMy/z x=24 40 y=T R z=ES ESS DS DSS
• Mitsubishi Electric FX5U-xMy/z x=32 64 80 y=T R z=ES DS ESS DSS
• Mitsubishi Electric FX5UC-xMy/z x=32 64 96 y=T z=D DSS
• Mitsubishi Electric FX5UC-32MT/DS-TS FX5UC-32MT/DSS-TS FX5UC-32MR/DS-TS
• Mitsubishi Electric FX5UJ-xMy/z x=24 40 60 y=T R z=ES DS ESS DSS
• Mitsubishi Electric FX5UJ-xMy/ES-A* x=24 40 60 y=T R
• Mitsubishi Electric FX5S-xMy/z x=30 40 60 80* y=T R z=ES ESS

Remediation

Refer to Mitsubishi Electric Web site for patch, upgrade or suggested workaround information.

CVE-2023-4699

CVE-2023-4625