CVE-2023-1618

CVSS V2 None CVSS V3 None
Description
Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all versions allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unauthorized login can reset the module, and if certain conditions are met, he/she can disclose or tamper with the module's configuration or rewrite the firmware.
Overview
  • CVE ID
  • CVE-2023-1618
  • Assigner
  • Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
  • Vulnerability Status
  • Received
  • Published Version
  • 2023-05-19T05:15:20
  • Last Modified Date
  • 2023-05-19T05:15:20
Weakness Enumerations
CWE URL
CWE-489 http://cwe.mitre.org/data/definitions/489.html
References
Reference URL Reference Tags
https://jvn.jp/vu/JVNVU96063959
https://www.cisa.gov/news-events/ics-advisories/icsa-23-138-02
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-002_en.pdf
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-1618
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1618
History
Created Old Value New Value Data Type Notes
2023-05-19 06:00:25 Added to TrackCVE
2023-05-19 06:00:26 Weakness Enumeration new