CVE-2023-4625
Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the…
Does this matter?
Lower severity and a low EPSS score (0.95%). Track it; it rarely justifies an emergency change on its own.
Description
Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- EPSS
- 0.95% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-307
- Affected
- mitsubishielectric/fx5u-32mt\/es firmware · mitsubishielectric/fx5u-64mt\/es firmware · mitsubishielectric/fx5u-80mt\/es firmware · mitsubishielectric/fx5u-32mr\/es firmware · mitsubishielectric/fx5u-64mr\/es firmware · mitsubishielectric/fx5u-80mr\/es firmware · mitsubishielectric/fx5u-32mt\/ds firmware · mitsubishielectric/fx5u-64mt\/ds firmware · mitsubishielectric/fx5u-80mt\/ds firmware · mitsubishielectric/fx5u-32mr\/ds firmware · mitsubishielectric/fx5u-64mr\/ds firmware · mitsubishielectric/fx5u-80mr\/ds firmware · mitsubishielectric/fx5u-32mt\/ess firmware · mitsubishielectric/fx5u-64mt\/ess firmware · mitsubishielectric/fx5u-80mt\/ess firmware · mitsubishielectric/fx5u-32mt\/dss firmware · mitsubishielectric/fx5u-64mt\/dss firmware · mitsubishielectric/fx5u-80mt\/dss firmware · mitsubishielectric/fx5uc-32mt\/d firmware · mitsubishielectric/fx5uc-64mt\/d firmware · +40 more
- Source
- Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
References
- https://jvn.jp/vu/JVNVU94620134Third Party Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02Third Party Advisory, US Government Resource
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdfVendor Advisory
- https://jvn.jp/vu/JVNVU94620134Third Party Advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-306-02Third Party Advisory, US Government Resource
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-014_en.pdfVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.