CVE-2023-2062

Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP. This vulnerability results in authentication bypass vulnerability, which allows the attacker to access MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP via FTP.
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:mitsubishielectric:fx5-enet\/ip_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:fx5-enet\/ip:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:mitsubishielectric:sw1dnn-eipct-bd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:sw1dnn-eipct-bd:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:mitsubishielectric:rj71eip91_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:rj71eip91:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:mitsubishielectric:sw1dnn-eipctfx5-bd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:sw1dnn-eipctfx5-bd:-:*:*:*:*:*:*:*

History

31 Oct 2024, 23:15

Type Values Removed Values Added
References
  • () https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-02 -

16 Jun 2023, 14:56

Type Values Removed Values Added
First Time Mitsubishielectric rj71eip91 Firmware
Mitsubishielectric sw1dnn-eipct-bd Firmware
Mitsubishielectric
Mitsubishielectric fx5-enet\/ip Firmware
Mitsubishielectric rj71eip91
Mitsubishielectric sw1dnn-eipct-bd
Mitsubishielectric sw1dnn-eipctfx5-bd Firmware
Mitsubishielectric fx5-enet\/ip
Mitsubishielectric sw1dnn-eipctfx5-bd
CPE cpe:2.3:h:mitsubishielectric:rj71eip91:-:*:*:*:*:*:*:*
cpe:2.3:o:mitsubishielectric:sw1dnn-eipct-bd_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:sw1dnn-eipct-bd:-:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:sw1dnn-eipctfx5-bd:-:*:*:*:*:*:*:*
cpe:2.3:o:mitsubishielectric:rj71eip91_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:fx5-enet\/ip:-:*:*:*:*:*:*:*
cpe:2.3:o:mitsubishielectric:fx5-enet\/ip_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:mitsubishielectric:sw1dnn-eipctfx5-bd_firmware:-:*:*:*:*:*:*:*
References (MISC) https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2023-004.pdf - (MISC) https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2023-004.pdf - Vendor Advisory
References (MISC) https://jvn.jp/vu/JVNVU92908006 - (MISC) https://jvn.jp/vu/JVNVU92908006 - Third Party Advisory
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.2
CWE CWE-668

02 Jun 2023, 05:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-06-02 05:15

Updated : 2024-10-31 23:15


NVD link : CVE-2023-2062

Mitre link : CVE-2023-2062

CVE.ORG link : CVE-2023-2062


JSON object : View

Products Affected

mitsubishielectric

  • sw1dnn-eipctfx5-bd
  • sw1dnn-eipctfx5-bd_firmware
  • rj71eip91
  • fx5-enet\/ip_firmware
  • fx5-enet\/ip
  • sw1dnn-eipct-bd
  • rj71eip91_firmware
  • sw1dnn-eipct-bd_firmware
CWE
CWE-668

Exposure of Resource to Wrong Sphere

CWE-549

Missing Password Field Masking