CVE-2023-6374

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6374
Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://jvn.jp/vu/JVNVU99497477 Third Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03 Third Party Advisory US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:mitsubishielectric:melsec_ws0-geth00200_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:mitsubishielectric:melsec_ws0-geth00200:-:*:*:*:*:*:*:*
History

06 Feb 2024, 18:50

Type Values Removed Values Added
References () https://jvn.jp/vu/JVNVU99497477 - () https://jvn.jp/vu/JVNVU99497477 - Third Party Advisory
References () https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03 - () https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03 - Third Party Advisory, US Government Resource
References () https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf - () https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf - Vendor Advisory
First Time Mitsubishielectric
Mitsubishielectric melsec Ws0-geth00200
Mitsubishielectric melsec Ws0-geth00200 Firmware
CPE cpe:2.3:h:mitsubishielectric:melsec_ws0-geth00200:-:*:*:*:*:*:*:*
cpe:2.3:o:mitsubishielectric:melsec_ws0-geth00200_firmware:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : 5.9 		v2 : unknown
v3 : 7.5

31 Jan 2024, 09:15

Type Values Removed Values Added
References
  • () https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03 -

30 Jan 2024, 14:18

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de omisión de autenticación mediante Capture-replay en Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200, todos los números de serie permite a un atacante remoto no autenticado omitir la autenticación mediante un ataque de Capture-replay e iniciar sesión ilegalmente en el módulo afectado. Como resultado, el atacante remoto que ha iniciado sesión ilegalmente puede revelar o alterar los programas y parámetros de los módulos.

30 Jan 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-30 09:15

Updated : 2024-02-06 18:50

NVD link : CVE-2023-6374

Mitre link : CVE-2023-6374

CVE.ORG link : CVE-2023-6374

JSON object : View

Products Affected

mitsubishielectric

  • melsec_ws0-geth00200
  • melsec_ws0-geth00200_firmware
CWE
CWE-294

Authentication Bypass by Capture-replay