ICSA-23-157-02

Vulnerability from csaf_cisa - Published: 2023-06-06 06:00 - Updated: 2025-12-02 07:00
Summary
Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series (Update C)

Notes

Legal Notice and Terms of Use
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
Risk evaluation
Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to connect to the module via FTP and bypass authentication to log in.
Critical infrastructure sectors
Critical Manufacturing
Countries/areas deployed
Worldwide
Company headquarters location
Japan
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices
Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Recommended Practices
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
To clipboard 

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Iie Karada"
        ],
        "summary": "reporting these vulnerabilities to Mitsubishi Electric"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy \u0026 Use policy (https://www.cisa.gov/privacy-policy).",
        "title": "Legal Notice and Terms of Use"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could allow a remote unauthenticated attacker to connect to the module via FTP and bypass authentication to log in.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Japan",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-23-157-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2023/icsa-23-157-02.json"
      },
      {
        "category": "self",
        "summary": "ICSA Advisory ICSA-23-157-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/secure-our-world/teach-employees-avoid-phishing"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks"
      }
    ],
    "title": "Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series (Update C)",
    "tracking": {
      "current_release_date": "2025-12-02T07:00:00.000000Z",
      "generator": {
        "date": "2025-12-01T23:13:38.346639Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-23-157-02",
      "initial_release_date": "2023-06-06T06:00:00.000000Z",
      "revision_history": [
        {
          "date": "2023-06-06T06:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Initial Publication"
        },
        {
          "date": "2024-04-25T06:00:00.000000Z",
          "legacy_version": "Update A",
          "number": "2",
          "summary": "Update A - Added mitigation information."
        },
        {
          "date": "2024-10-31T06:00:00.000000Z",
          "legacy_version": "Update B",
          "number": "3",
          "summary": "Update B - Added version information to affected products section."
        },
        {
          "date": "2025-12-02T07:00:00.000000Z",
          "legacy_version": "Update C",
          "number": "4",
          "summary": "Update C - Recommend replacing FX5-ENET/IP with EtherNet/IP Module FX5-EIP."
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric RJ71EIP91: vers:all/*",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "RJ71EIP91"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Mitsubishi Electric FX5-ENET/IP: vers:all/*",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "FX5-ENET/IP"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=1.01B",
                "product": {
                  "name": "Mitsubishi Electric SW1DNN-EIPCT-BD: \u003c=1.01B",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "SW1DNN-EIPCT-BD"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=1.01B",
                "product": {
                  "name": "Mitsubishi Electric SW1DNN-EIPCTFX5-BD: \u003c=1.01B",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "SW1DNN-EIPCTFX5-BD"
          }
        ],
        "category": "vendor",
        "name": "Mitsubishi Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-2060",
      "cwe": {
        "id": "CWE-521",
        "name": "Weak Password Requirements"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability in FTP function in the EtherNet/IP module caused by weak password requirements may allow a remote unauthenticated attacker to access to the module via FTP by a dictionary attack or password sniffing. ",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-2060"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric recommends that users of the affected products take the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "RJ71EIP91: Consider replacing with the next generation model, CC-Link IE TSN Plus Master/Local Module RJ71GN11-EIP.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "RJ71EIP91 firmware version \"06\" or later: The FTP function can be disabled in firmware version \"06\" or later. To prevent unauthorized access from outside, set the connection to \u0027Deny connection\u0027 in the EtherNet/IP Configuration Tool Connection Permission Change function and disable the module\u0027s FTP function, except when configuring with the EtherNet/IP Configuration Tool. However, firmware versions earlier than \"06\" cannot be updated to version \"06\" or later. For detailed configuration instructions, refer to the following manuals: MELSEC iQ-R EtherNet/IP Module User\u0027s Manual (Application) \"1.3 Ethernet/IP Configuration Tool Connectable Function\".",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP: There are no plans to release a fixed version, so take mitigations and workarounds below. In addition, consider replacing it with the next-generation model, the EtherNet/IP Module FX5-EIP.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP: Use IP filter function to block access from untrusted hosts. For details on the IP filter function, refer to the following manual: \"12.1 IP Filter Function\" in the MELSEC iQ-F FX5 User\u0027s Manual (Ethernet Communication).",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP firmware version \"1.106\" or later: The FTP function can be disabled. To prevent unauthorized access from outside, set the connection to \"Deny connection\" in the EtherNet/IP Configuration Tool for FX5-ENET/IP Tool connection setting change function and disable the module\u0027s FTP function, except when configuring with the EtherNet/IP Configuration Tool for FX5-ENET/IP. For detailed configuration instructions, refer to the following manuals: \"Tool connection setting change function\" in the \"Details of buffer memory addresses\" in the \"Appendix 4 Buffer Memory\" in the \"MELSEC iQ-F FX5 EtherNet/IP Module User\u0027s Manual.\"",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities common to RJ71EIP91 and FX5-ENET/IP:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use within a LAN and block access from untrusted networks and hosts through firewalls.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict physical access to prevent untrusted devices from connecting to the LAN to which the affected product is connected.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Avoid uploading/downloading files directly using FTP, and use the EtherNet/IP configuration tool. Also, do not open the downloaded file with anything other than the EtherNet/IP configuration tool.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Allow only trusted users to log in or remotely log in.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure that no one else can view the screen of a user from behind while using the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If you leave your desk while using the product, lock your PC to prevent others from using it.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Operate the PC using the product within a LAN and block access from untrusted networks or hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict physical access to the PC on which the product is installed, as well as the PCs and network devices that can communicate with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Install antivirus software on the PCs that use the product, as well as on the PCs that can communicate with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not open untrusted files or click on untrusted links.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For specific update instructions and additional details see the Mitsubishi Electric advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-004_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-2061",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An authentication bypass vulnerability in the FTP function in the EtherNet/IP module caused by the use of hard-coded credentials may allow a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-2061"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric recommends that users of the affected products take the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "RJ71EIP91: Consider replacing with the next generation model, CC-Link IE TSN Plus Master/Local Module RJ71GN11-EIP.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "RJ71EIP91 firmware version \"06\" or later: The FTP function can be disabled in firmware version \"06\" or later. To prevent unauthorized access from outside, set the connection to \u0027Deny connection\u0027 in the EtherNet/IP Configuration Tool Connection Permission Change function and disable the module\u0027s FTP function, except when configuring with the EtherNet/IP Configuration Tool. However, firmware versions earlier than \"06\" cannot be updated to version \"06\" or later. For detailed configuration instructions, refer to the following manuals: MELSEC iQ-R EtherNet/IP Module User\u0027s Manual (Application) \"1.3 Ethernet/IP Configuration Tool Connectable Function\".",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP: There are no plans to release a fixed version, so take mitigations and workarounds below. In addition, consider replacing it with the next-generation model, the EtherNet/IP Module FX5-EIP.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP: Use IP filter function to block access from untrusted hosts. For details on the IP filter function, refer to the following manual: \"12.1 IP Filter Function\" in the MELSEC iQ-F FX5 User\u0027s Manual (Ethernet Communication).",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP firmware version \"1.106\" or later: The FTP function can be disabled. To prevent unauthorized access from outside, set the connection to \"Deny connection\" in the EtherNet/IP Configuration Tool for FX5-ENET/IP Tool connection setting change function and disable the module\u0027s FTP function, except when configuring with the EtherNet/IP Configuration Tool for FX5-ENET/IP. For detailed configuration instructions, refer to the following manuals: \"Tool connection setting change function\" in the \"Details of buffer memory addresses\" in the \"Appendix 4 Buffer Memory\" in the \"MELSEC iQ-F FX5 EtherNet/IP Module User\u0027s Manual.\"",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities common to RJ71EIP91 and FX5-ENET/IP:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use within a LAN and block access from untrusted networks and hosts through firewalls.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict physical access to prevent untrusted devices from connecting to the LAN to which the affected product is connected.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Avoid uploading/downloading files directly using FTP, and use the EtherNet/IP configuration tool. Also, do not open the downloaded file with anything other than the EtherNet/IP configuration tool.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Allow only trusted users to log in or remotely log in.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure that no one else can view the screen of a user from behind while using the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If you leave your desk while using the product, lock your PC to prevent others from using it.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Operate the PC using the product within a LAN and block access from untrusted networks or hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict physical access to the PC on which the product is installed, as well as the PCs and network devices that can communicate with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Install antivirus software on the PCs that use the product, as well as on the PCs that can communicate with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not open untrusted files or click on untrusted links.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For specific update instructions and additional details see the Mitsubishi Electric advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-004_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-2062",
      "cwe": {
        "id": "CWE-549",
        "name": "Missing Password Field Masking"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The EtherNet/IP configuration tool displays an unmasked password due to the lack of password field masking may allow a remote unauthenticated attacker to access the module via FTP.",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003",
          "CSAFPID-0004"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-2062"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric recommends that users of the affected products take the following actions:",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "SW1DNN-EIPCT-BD: Download and update the fixed version Software version \"1.02C\" or later",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.mitsubishielectric.com/fa/#software"
        },
        {
          "category": "vendor_fix",
          "details": "SW1DNN-EIPCTFX5-BD: Download and update the fixed version Software version \"1.02C\" or later.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.mitsubishielectric.com/fa/#software"
        },
        {
          "category": "mitigation",
          "details": "Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use within a LAN and block access from untrusted networks and hosts through firewalls.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict physical access to prevent untrusted devices from connecting to the LAN to which the affected product is connected.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Avoid uploading/downloading files directly using FTP, and use the EtherNet/IP configuration tool. Also, do not open the downloaded file with anything other than the EtherNet/IP configuration tool.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploitation of these vulnerabilities common to SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD:",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Allow only trusted users to log in or remotely log in.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure that no one else can view the screen of a user from behind while using the product.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "If you leave your desk while using the product, lock your PC to prevent others from using it.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Operate the PC using the product within a LAN and block access from untrusted networks or hosts.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict physical access to the PC on which the product is installed, as well as the PCs and network devices that can communicate with the product.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Install antivirus software on the PCs that use the product, as well as on the PCs that can communicate with the product.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not open untrusted files or click on untrusted links.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        },
        {
          "category": "mitigation",
          "details": "For specific update instructions and additional details see the Mitsubishi Electric advisory.",
          "product_ids": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-004_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2023-2063",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An information disclosure, tampering, deletion, destruction vulnerability exists in the FTP function in the EtherNet/IP module via a file upload/download due to unrestricted upload of file with dangerous type. ",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-2063"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Mitsubishi Electric recommends that users of the affected products take the following actions:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "RJ71EIP91: Consider replacing with the next generation model, CC-Link IE TSN Plus Master/Local Module RJ71GN11-EIP.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "RJ71EIP91 firmware version \"06\" or later: The FTP function can be disabled in firmware version \"06\" or later. To prevent unauthorized access from outside, set the connection to \u0027Deny connection\u0027 in the EtherNet/IP Configuration Tool Connection Permission Change function and disable the module\u0027s FTP function, except when configuring with the EtherNet/IP Configuration Tool. However, firmware versions earlier than \"06\" cannot be updated to version \"06\" or later. For detailed configuration instructions, refer to the following manuals: MELSEC iQ-R EtherNet/IP Module User\u0027s Manual (Application) \"1.3 Ethernet/IP Configuration Tool Connectable Function\".",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP: There are no plans to release a fixed version, so take mitigations and workarounds below. In addition, consider replacing it with the next-generation model, the EtherNet/IP Module FX5-EIP.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP: Use IP filter function to block access from untrusted hosts. For details on the IP filter function, refer to the following manual: \"12.1 IP Filter Function\" in the MELSEC iQ-F FX5 User\u0027s Manual (Ethernet Communication).",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "FX5-ENET/IP firmware version \"1.106\" or later: The FTP function can be disabled. To prevent unauthorized access from outside, set the connection to \"Deny connection\" in the EtherNet/IP Configuration Tool for FX5-ENET/IP Tool connection setting change function and disable the module\u0027s FTP function, except when configuring with the EtherNet/IP Configuration Tool for FX5-ENET/IP. For detailed configuration instructions, refer to the following manuals: \"Tool connection setting change function\" in the \"Details of buffer memory addresses\" in the \"Appendix 4 Buffer Memory\" in the \"MELSEC iQ-F FX5 EtherNet/IP Module User\u0027s Manual.\"",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting these vulnerabilities common to RJ71EIP91 and FX5-ENET/IP:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use a firewall, virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use within a LAN and block access from untrusted networks and hosts through firewalls.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict physical access to prevent untrusted devices from connecting to the LAN to which the affected product is connected.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Avoid uploading/downloading files directly using FTP, and use the EtherNet/IP configuration tool. Also, do not open the downloaded file with anything other than the EtherNet/IP configuration tool.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Allow only trusted users to log in or remotely log in.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Ensure that no one else can view the screen of a user from behind while using the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "If you leave your desk while using the product, lock your PC to prevent others from using it.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Operate the PC using the product within a LAN and block access from untrusted networks or hosts.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restrict physical access to the PC on which the product is installed, as well as the PCs and network devices that can communicate with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Install antivirus software on the PCs that use the product, as well as on the PCs that can communicate with the product.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "Do not open untrusted files or click on untrusted links.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        },
        {
          "category": "mitigation",
          "details": "For specific update instructions and additional details see the Mitsubishi Electric advisory.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-004_en.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ]
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.