VAR-202402-1450

Vulnerability from variot - Updated: 2024-06-07 22:53

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet. Provided by Mitsubishi Electric Corporation MELSEC iQ-R series safety CPU and SIL2 process CPU Unit is vulnerable to improper permission settings (CWE-266 , CVE-2023-6815) exists. This vulnerability information is provided by the developer for the purpose of dissemination to product users. ( A user ID and password ) may be obtained. Mitsubishi Electric MELSEC iQ-R series is a programmable logic controller of Mitsubishi Electric Corporation of Japan

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202402-1450",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "melsec iq-r \u30b7\u30ea\u30fc\u30ba",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u4e09\u83f1\u96fb\u6a5f",
        "version": null
      },
      {
        "model": "melsec iq-r \u30b7\u30ea\u30fc\u30ba",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u4e09\u83f1\u96fb\u6a5f",
        "version": "melsec iq-r  series safety  cpu r08/16/32/120sfcpu  all  s"
      },
      {
        "model": "melsec iq-r \u30b7\u30ea\u30fc\u30ba",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "\u4e09\u83f1\u96fb\u6a5f",
        "version": "melsec iq-r  series  sil2  process  cpu r08/16/32/120psfcpu  all  s"
      },
      {
        "model": "electric mitsubishi melsec iq-r series safety cpu r08/16/32/120sfcpu",
        "scope": null,
        "trust": 0.6,
        "vendor": "mitsubishi",
        "version": null
      },
      {
        "model": "electric melsec iq-r series sil2 process cpu r08/16/32/120psfcpu",
        "scope": null,
        "trust": 0.6,
        "vendor": "mitsubishi",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      }
    ]
  },
  "cve": "CVE-2023-6815",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CNVD-2024-26018",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "OTHER",
            "availabilityImpact": "None",
            "baseScore": 6.5,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2024-002399",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "Low",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
            "id": "CVE-2023-6815",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "OTHER",
            "id": "JVNDB-2024-002399",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2024-26018",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-6815"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet. Provided by Mitsubishi Electric Corporation MELSEC iQ-R series safety CPU and SIL2 process CPU Unit is vulnerable to improper permission settings (CWE-266 , CVE-2023-6815) exists. This vulnerability information is provided by the developer for the purpose of dissemination to product users. ( A user ID and password ) may be obtained. Mitsubishi Electric MELSEC iQ-R series is a programmable logic controller of Mitsubishi Electric Corporation of Japan",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2023-6815"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-6815"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2023-6815",
        "trust": 2.5
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-24-044-01",
        "trust": 1.9
      },
      {
        "db": "JVN",
        "id": "JVNVU95085830",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399",
        "trust": 0.8
      },
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-6815",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-6815"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-6815"
      }
    ]
  },
  "id": "VAR-202402-1450",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      }
    ]
  },
  "last_update_date": "2024-06-07T22:53:08.079000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "MELSEC\u00a0iQ-R\u00a0 series safety \u00a0CPU\u00a0 as well as \u00a0SIL2\u00a0 process \u00a0CPU\u00a0 Vulnerability of information leakage in units",
        "trust": 0.8,
        "url": "https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2023-021.pdf"
      },
      {
        "title": "Patch for Mitsubishi Electric MELSEC iQ-R series information disclosure vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/554321"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-266",
        "trust": 1.0
      },
      {
        "problemtype": "Improper permission settings (CWE-266) [ others ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-6815"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.0,
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01"
      },
      {
        "trust": 1.9,
        "url": "https://jvn.jp/vu/jvnvu95085830/index.html"
      },
      {
        "trust": 1.7,
        "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/266.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-6815"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-6815"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "db": "VULMON",
        "id": "CVE-2023-6815"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      },
      {
        "db": "NVD",
        "id": "CVE-2023-6815"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-06-06T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "date": "2024-02-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2023-6815"
      },
      {
        "date": "2024-02-14T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      },
      {
        "date": "2024-02-13T07:15:46.843000",
        "db": "NVD",
        "id": "CVE-2023-6815"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-06-05T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2024-26018"
      },
      {
        "date": "2024-02-14T00:00:00",
        "db": "VULMON",
        "id": "CVE-2023-6815"
      },
      {
        "date": "2024-05-17T07:24:00",
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      },
      {
        "date": "2024-02-14T04:15:08.497000",
        "db": "NVD",
        "id": "CVE-2023-6815"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Made by Mitsubishi Electric \u00a0MELSEC\u00a0iQ-R\u00a0 series safety \u00a0CPU\u00a0 and \u00a0SIL2\u00a0 process \u00a0CPU\u00a0 Unit Improper Permission Setting Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2024-002399"
      }
    ],
    "trust": 0.8
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.