Mitsubishi Electric MELSEC iQ-F Packets buffer overflow

Summaryinfo

A vulnerability classified as critical has been found in Mitsubishi Electric MELSEC iQ-F. This affects an unknown part of the component Packets Handler. The manipulation leads to buffer overflow. This vulnerability is documented as CVE-2023-1424. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Mitsubishi Electric MELSEC iQ-F (version now known). This issue affects some unknown processing of the component Packets Handler. The manipulation with an unknown input leads to a buffer overflow vulnerability. Using CWE to declare the problem leads to CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution.

The weakness was released 05/24/2023. The advisory is shared at jvn.jp. The identification of this vulnerability is CVE-2023-1424 since 03/16/2023. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/24/2023).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Mitsubishi Electric

Name

• MELSEC iQ-F

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion