CVE-2023-3346CWE-120

Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series

Critical · published August 3, 2023

CVSS v3.1
9.8
EPSS
2%
Percentile
81.5
In the wild
Unconfirmed
What it is

🔥 A classic buffer overflow vulnerability in MITSUBSHI CNC Series can turn your operations into chaos! An attacker just needs to send specially crafted packets—no authentication required! Think of it like a delivery truck overflowing with packages that doesn't fit in the loading dock—eventually, the entire operation comes to a halt. In this case, the overflow causes a Denial of Service (DoS), requiring a complete system reset to get back on track! The consequences here could be absolutely devastating! A remote attacker could bring your system down, leading to unexpected downtime and disruption, all while being able to execute arbitrary code at their whim. This is not just a minor hiccup; it’s a critical failure that can halt productivity and compromise security.

Put simply

Think of it like a delivery truck overflowing with packages that doesn't fit in the loading dock—eventually, the entire operation comes to a halt. In this case, the overflow causes a Denial of Service (DoS), requiring a complete system reset to get back on track! The vulnerability arises from a buffer copy process that fails to check the size of the input, which allows an attacker to craft packets that exceed this limit. This oversight can lead to a Denial of Service and potential execution of unauthorized code.

What to do

The consequences here could be absolutely devastating! A remote attacker could bring your system down, leading to unexpected downtime and disruption, all while being able to execute arbitrary code at their whim. This is not just a minor hiccup; it’s a critical failure that can halt productivity and compromise security. To remediate this critical vulnerability, urgently patch your MITSUBSHI CNC Series to the latest version provided by the vendor. Additionally, ensure your network is configured to restrict unauthorized access attempts, and monitor for any unusual traffic patterns that could indicate an exploitation attempt. You've got this! By taking the right actions now, you'll safeguard your systems and maintain your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02095 · 81.5th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2023-08-03T04:00Z
EPSS history
Timeline
  • 03 AUG 04:00Z
    Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series
    cvelistv5