CVE-2023-4625
mediumPriorität · verfolgen · 21EPSS 0.009 · 61. PerzentilEUUSEPSS · bewertet 2026-10-27
Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationFX5S-xMy/z x=30,40,60,80*, y=T,R, z=ES,ESScisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationFX5U-xMy/z x=32,64,80, y=T,R, z=ES,DS,ESS,DSS (Serial number 179**** and prior)cisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationFX5U-xMy/z x=32,64,80, y=T,R, z=ES,DS,ESS,DSS (Serial number 17X**** and later)cisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationFX5UC-32MT/DS-TS, FX5UC-32MT/DSS-TS, FX5UC-32MR/DS-TScisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationFX5UC-xMy/z x=32,64,96, y=T, z=D,DSS (Serial number 179**** and prior)cisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationFX5UC-xMy/z x=32,64,96, y=T, z=D,DSS (Serial number 17X**** and later)cisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationFX5UJ-xMy/ES-A* x=24,40,60, y=T,Rcisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationFX5UJ-xMy/z x=24,40,60, y=T,R, z=ES,DS,ESS,DSScisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationR00/01/02CPUcisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationR04/08/16/32/120(EN)CPUcisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
- MitigationR08/16/32/120/PCPUcisa_csaf_ot
Mitsubishi Electric recommends that users take the following mitigation measures to minimize the risk:
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (189)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-23-306-02Mitsubishi Electric MELSEC iQ-F/iQ-R Series CPU Module (Update A)2023-11-02icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow a remote attacker to prevent legitimate users from logging into the web server function for a certain period, resulting in a denial-of-service condition. The impact of this vulnerability will persist while the attacker continues to attempt the attack.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (10)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2023-4625/cnnvd
- https://jvn.jp/vu/JVNVU94620134cnnvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02cnnvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdfcnnvd
- https://jvn.jp/vu/JVNVU94620134enisa_euvd
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02enisa_euvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdfenisa_euvd
- https://jvn.jp/vu/JVNVU94620134Third Party Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan