Buffer overflow in Mitsubishi Electric products - CVE-2023-1424
Published: May 24, 2023 / Updated: May 29, 2023
Vulnerability identifier: #VU76484
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-1424
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
MELSEC iQ-F FX5U
MELSEC iQ-F FX5UC
MELSEC iQ-F FX5UC-32MT/DS-TS
MELSEC iQ-F FX5UC-32MT/DSS-TS
MELSEC iQ-F FX5UC-32MR/DS-TS
MELSEC iQ-F FX5UC
MELSEC iQ-F FX5UC-32MT/DS-TS
MELSEC iQ-F FX5UC-32MT/DSS-TS
MELSEC iQ-F FX5UC-32MR/DS-TS
How to mitigate CVE-2023-1424
Install updates from vendor's website.
MELSEC iQ-F FX5U - update to 1.290
MELSEC iQ-F FX5UC - update to 1.290
MELSEC iQ-F FX5UC-32MT/DS-TS - update to 1.290
MELSEC iQ-F FX5UC-32MT/DSS-TS - update to 1.290
MELSEC iQ-F FX5UC-32MR/DS-TS - update to 1.290
MELSEC iQ-F FX5UC - update to 1.290
MELSEC iQ-F FX5UC-32MT/DS-TS - update to 1.290
MELSEC iQ-F FX5UC-32MT/DSS-TS - update to 1.290
MELSEC iQ-F FX5UC-32MR/DS-TS - update to 1.290