Vulnerability Details : CVE-2023-1618

Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unauthorized login can reset the module, and if certain conditions are met, he/she can disclose or tamper with the module's configuration or rewrite the firmware.
Published 2023-05-19 05:15:20
Updated 2023-08-23 01:15:10
Source Mitsubishi Electric Corporation
View at NVD,   CVE.org

Products affected by CVE-2023-1618

Exploit prediction scoring system (EPSS) score for CVE-2023-1618

EPSS FAQ
0.17%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 54 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-1618

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
3.9
3.6
 Mitsubishi Electric Corporation
8.6
 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
3.9
4.7
 NIST

CWE ids for CVE-2023-1618

  • The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
    Assigned by: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (Secondary)
  • The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-1618

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close