CVE-2023-3346 : Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a re

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.

Published 2023-08-03 05:15:11

Updated 2023-08-11 21:01:54

Source Mitsubishi Electric Corporation

View at NVD, CVE.org

Vulnerability category: OverflowExecute codeDenial of service

Exploit prediction scoring system (EPSS) score for CVE-2023-3346

EPSS FAQ

0.74%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-3346

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	Mitsubishi Electric Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-3346

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by:

Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp (Secondary)
nvd@nist.gov (Primary)

References for CVE-2023-3346

Products affected by CVE-2023-3346

Mitsubishielectric » C80 Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:c80_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » C80 » Version: N/A
Mitsubishielectric » E70 Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:e70_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » E70 » Version: N/A
Mitsubishielectric » E80 Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:e80_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » E80 » Version: N/A
Mitsubishielectric » M70v Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m70v_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M70v » Version: N/A
Mitsubishielectric » M720vs Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m720vs_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M720vs » Version: N/A
Mitsubishielectric » M720vs 15-type Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m720vs_15-type_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M720vs 15-type » Version: N/A
Mitsubishielectric » M720vw Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m720vw_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M720vw » Version: N/A
Mitsubishielectric » M730vs Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m730vs_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M730vs » Version: N/A
Mitsubishielectric » M730vs 15-type Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m730vs_15-type_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M730vs 15-type » Version: N/A
Mitsubishielectric » M730vw Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m730vw_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M730vw » Version: N/A
Mitsubishielectric » M750vs Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m750vs_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M750vs » Version: N/A
Mitsubishielectric » M750vs 15-type Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m750vs_15-type_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M750vs 15-type » Version: N/A
Mitsubishielectric » M750vw Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m750vw_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M750vw » Version: N/A
Mitsubishielectric » M80 Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m80_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M80 » Version: N/A
Mitsubishielectric » M800s Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m800s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M800s » Version: N/A
Mitsubishielectric » M800vs Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m800vs_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M800vs » Version: N/A
Mitsubishielectric » M800vw Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m800vw_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M800vw » Version: N/A
Mitsubishielectric » M800w Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m800w_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M800w » Version: N/A
Mitsubishielectric » M80v Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m80v_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M80v » Version: N/A
Mitsubishielectric » M80vw Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m80vw_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M80vw » Version: N/A
Mitsubishielectric » M80w Firmware » Version: N/A
cpe:2.3:o:mitsubishielectric:m80w_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » M80w » Version: N/A

Vulnerability Details : CVE-2023-3346

Exploit prediction scoring system (EPSS) score for CVE-2023-3346

CVSS scores for CVE-2023-3346

CWE ids for CVE-2023-3346

References for CVE-2023-3346

Products affected by CVE-2023-3346