CVE-2023-1618CWE-489

Authentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface Module

High · published May 19, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

Active Debug Code vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 Serial number 2310 **** and prior allows a remote unauthenticated attacker to bypass authentication and illegally log into the affected module by connecting to it via telnet which is hidden function and is enabled by default when shipped from the factory. As a result, a remote attacker with unauthorized login can reset the module, and if certain conditions are met, he/she can disclose or tamper with the module's configuration or rewrite the firmware.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01132 · 66.2th percentile
Weakness
CWE-489 · Active Debug Code
Published
2023-05-19T04:19Z
EPSS history
Timeline
  • 19 MAY 04:19Z
    Authentication Bypass Vulnerability in MELSEC WS Series Ethernet Interface Module
    cvelistv5