CVE-2023-2062
02.06.2023, 05:15
Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP. This vulnerability results in authentication bypass vulnerability, which allows the attacker to access MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP via FTP.Enginsight
| Vendor | Product | Version |
|---|---|---|
| mitsubishielectric | fx5-enet\/ip_firmware | - |
| mitsubishielectric | sw1dnn-eipct-bd_firmware | - |
| mitsubishielectric | rj71eip91_firmware | - |
| mitsubishielectric | sw1dnn-eipctfx5-bd_firmware | - |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-549 - Missing Password Field MaskingThe software does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
- CWE-668 - Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.