CVE-2023-3346
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.10%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.10% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- mitsubishielectric/c80 firmware · mitsubishielectric/e70 firmware · mitsubishielectric/e80 firmware · mitsubishielectric/m70v firmware · mitsubishielectric/m720vs firmware · mitsubishielectric/m720vs 15-type firmware · mitsubishielectric/m720vw firmware · mitsubishielectric/m730vs firmware · mitsubishielectric/m730vs 15-type firmware · mitsubishielectric/m730vw firmware · mitsubishielectric/m750vs firmware · mitsubishielectric/m750vs 15-type firmware · mitsubishielectric/m750vw firmware · mitsubishielectric/m80 firmware · mitsubishielectric/m800s firmware · mitsubishielectric/m800vs firmware · mitsubishielectric/m800vw firmware · mitsubishielectric/m800w firmware · mitsubishielectric/m80v firmware · mitsubishielectric/m80vw firmware · +1 more
- Source
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
References
- https://jvn.jp/vu/JVNVU90352157/index.htmlThird Party Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-03Third Party Advisory, US Government Resource
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdfVendor Advisory
- https://jvn.jp/vu/JVNVU90352157/index.htmlThird Party Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-03Third Party Advisory, US Government Resource
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdfVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.