SB2023060704 - Multiple vulnerabilities in Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series, EtherNet/IP Modules and EtherNet/IP
Published: June 7, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Weak password requirements (CVE-ID: CVE-2023-2060)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to weak password requirements in FTP function on EtherNet/IP module. A remote attacker can access to the module via FTP by dictionary attack or password sniffing.
2) Use of Hard-coded Password (CVE-ID: CVE-2023-2061)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to use a hard-coded password within the FTP function on EtherNet/IP module. A remote attacker can obtain a hard-coded password and access to the module.
3) Missing Password Field Masking (CVE-ID: CVE-2023-2062)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to missing password field masking in the EtherNet/IP configuration tool. A remote attacker can gain access to unmasked passwords.
4) Arbitrary file upload (CVE-ID: CVE-2023-2063)
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to insufficient validation of file during file upload in the FTP function on EtherNet/IP module. A remote user can upload a malicious file and execute it on the server.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.