High severity · published May 24, 2023
CVE-2023-1424
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSEC iQ-R Series CPU…
8.1
CVSS
3.4%
EPSS
No
On KEV
Description
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSEC iQ-R Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MI
Melsec Iq-fx5u-32mr/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-32mr/dss Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-32mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-32mr/ess Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-32mt/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-32mt/dss Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-32mt/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-32mt/ess Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-64mr/ds Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-64mr/dss Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-64mr/es Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
MI
Melsec Iq-fx5u-64mr/ess Firmware · Mitsubishielectric
All versions, or not specified · source: NVD
Affected product
MI
Melsec Iq-fx5u-32mr/ds Firmware
Mitsubishielectric
More from Melsec Iq-fx5u-32mr/ds Firmware
8.6
CVE-2022-25161
Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later and versions…
5.3
CVE-2022-25162
Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U-xMy/z(x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later and versions…