CVE-2023-4699 Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products

🗓️ 06 Nov 2023 05:02:15Reported by MitsubishiType

vulnrichment🔗 github.com👁 22 Views

CVE-2023-4699 allows command execution via unprotected Mitsubishi Electric products.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerabilities of the microprogrammed software for Ethernet communication adapters, the FX3U-ENETADP/Ethernet Communication Block FX3U-ENET(-L), and the microprogrammed software for programmable logic controllers MELSEC iQ-F and MELSEC-F, allow attackers to cause malfunctions in the equipment’s operation.	16 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-4699	6 Nov 202312:25	–	circl
CNNVD	Mitsubishi Electric MELSEC iQ-F series and Mitsubishi Electric MELSEC-F Series Data Forgery Issue Vulnerability	6 Nov 202300:00	–	cnnvd
CVE	CVE-2023-4699	6 Nov 202305:02	–	cve
Cvelist	CVE-2023-4699 Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products	6 Nov 202305:02	–	cvelist
EUVD	EUVD-2023-54547	3 Oct 202520:07	–	euvd
ICS	Mitsubishi Electric FA products (Update A)	2 Nov 202306:00	–	ics
Kitploit	Citrix-Bleed-Buffer-Overread-Demo	16 Sep 202609:17	–	kitploit
NVD	CVE-2023-4699	6 Nov 202306:15	–	nvd
Prion	Design/Logic Flaw	6 Nov 202306:15	–	prion

Source	Link
jvn	www.jvn.jp/vu/JVNVU94620134/
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-306-03
mitsubishielectric	www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-013_en.pdf

12 Nov 2024 23:26Current

9.7Critical risk

Vulners AI Score9.7

CVSS 3.110

EPSS0.00748

SSVC

cve-2023-4699 arbitrary command execution mitsubishi electric missing authentication remote attack information disclosure denial of service