CVE-2023-6815

View on CVE.org

Published Feb 13, 2024 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mitsubishi Electric Corporation

MELSEC iQ-R Series Safety CPU R08SFCPU

unaffected

Version	Status	Constraints
`all versions`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series Safety CPU R16SFCPU

unaffected

Version	Status	Constraints
`all versions`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series Safety CPU R32SFCPU

unaffected

Version	Status	Constraints
`all versions`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series Safety CPU R120SFCPU

unaffected

Version	Status	Constraints
`all versions`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU

unaffected

Version	Status	Constraints
`all versions`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series SIL2 Process CPU R16PSFCPU

unaffected

Version	Status	Constraints
`all versions`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series SIL2 Process CPU R32PSFCPU

unaffected

Version	Status	Constraints
`all versions`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series SIL2 Process CPU R120PSFCPU

unaffected

Version	Status	Constraints
`all versions`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-59025	Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.697% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://jvn.jp/vu/JVNVU95085830/index.html
https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf

History

Oct 22, 2024 1:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mitsubishielectric Mitsubishielectric r08psfcpu Mitsubishielectric r08psfcpu Firmware Mitsubishielectric r08sfcpu Mitsubishielectric r08sfcpu Firmware Mitsubishielectric r120psfcpu Mitsubishielectric r120psfcpu Firmware Mitsubishielectric r120sfcpu Mitsubishielectric r120sfcpu Firmware Mitsubishielectric r16psfcpu Mitsubishielectric r16psfcpu Firmware Mitsubishielectric r16sfcpu Mitsubishielectric r16sfcpu Firmware Mitsubishielectric r32psfcpu Mitsubishielectric r32psfcpu Firmware Mitsubishielectric r32sfcpu Mitsubishielectric r32sfcpu Firmware
CPEs		cpe:2.3:h:mitsubishielectric:r08psfcpu:-:::::::* cpe:2.3:h:mitsubishielectric:r08sfcpu:-:::::::* cpe:2.3:h:mitsubishielectric:r120psfcpu:-:::::::* cpe:2.3:h:mitsubishielectric:r120sfcpu:-:::::::* cpe:2.3:h:mitsubishielectric:r16psfcpu:-:::::::* cpe:2.3:h:mitsubishielectric:r16sfcpu:-:::::::* cpe:2.3:h:mitsubishielectric:r32psfcpu:-:::::::* cpe:2.3:h:mitsubishielectric:r32sfcpu:-:::::::* cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:::::::: cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:::::::: cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:::::::: cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:::::::: cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:::::::: cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:::::::: cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:::::::: cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware::::::::
Vendors & Products		Mitsubishielectric Mitsubishielectric r08psfcpu Mitsubishielectric r08psfcpu Firmware Mitsubishielectric r08sfcpu Mitsubishielectric r08sfcpu Firmware Mitsubishielectric r120psfcpu Mitsubishielectric r120psfcpu Firmware Mitsubishielectric r120sfcpu Mitsubishielectric r120sfcpu Firmware Mitsubishielectric r16psfcpu Mitsubishielectric r16psfcpu Firmware Mitsubishielectric r16sfcpu Mitsubishielectric r16sfcpu Firmware Mitsubishielectric r32psfcpu Mitsubishielectric r32psfcpu Firmware Mitsubishielectric r32sfcpu Mitsubishielectric r32sfcpu Firmware

Subscriptions

Mitsubishielectric R08psfcpu R08psfcpu Firmware R08sfcpu R08sfcpu Firmware R120psfcpu R120psfcpu Firmware R120sfcpu R120sfcpu Firmware R16psfcpu R16psfcpu Firmware R16sfcpu R16sfcpu Firmware R32psfcpu R32psfcpu Firmware R32sfcpu R32sfcpu Firmware

Weaknesses

CWE-266

Sources

CVE record Updated: Aug 2, 2024, 8:42 AM

Status: PUBLISHED
Assigner: Mitsubishi
Published: Feb 13, 2024, 6:27 AM
Updated: Aug 2, 2024, 8:42 AM
Reserved: Dec 14, 2023, 2:59 AM

View source JSON

Vulnrichment Updated: May 23, 2024, 7:01 PM

Updated: May 23, 2024, 7:01 PM

NVD Updated: Jun 17, 2026, 6:51 AM

Status: Modified
Published: Feb 13, 2024, 7:15 AM
Modified: Jun 17, 2026, 6:51 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6815", "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "state": "PUBLISHED", "assignerShortName": "Mitsubishi", "dateReserved": "2023-12-14T02:59:09.887Z", "datePublished": "2024-02-13T06:27:51.202Z", "dateUpdated": "2024-08-02T08:42:07.419Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R08SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R16SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R32SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R120SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R16PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R32PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R120PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet."}], "value": "Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Information Disclosure"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "shortName": "Mitsubishi", "dateUpdated": "2024-02-14T03:59:42.705Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf"}, {"tags": ["government-resource"], "url": "https://jvn.jp/vu/JVNVU95085830/index.html"}, {"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6815", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-13T16:44:26.588675Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:17:01.365Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T08:42:07.419Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf"}, {"tags": ["government-resource", "x_transferred"], "url": "https://jvn.jp/vu/JVNVU95085830/index.html"}, {"tags": ["government-resource", "x_transferred"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01"}]}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-6815", "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "state": "PUBLISHED", "assignerShortName": "Mitsubishi", "dateReserved": "2023-12-14T02:59:09.887Z", "datePublished": "2024-02-13T06:27:51.202Z", "dateUpdated": "2024-06-04T17:17:01.365Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R08SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R16SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R32SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R120SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R16PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R32PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R120PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet."}], "value": "Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Information Disclosure"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "shortName": "Mitsubishi", "dateUpdated": "2024-02-14T03:59:42.705Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf"}, {"tags": ["government-resource"], "url": "https://jvn.jp/vu/JVNVU95085830/index.html"}, {"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-6815", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-13T16:44:26.588675Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:11.218Z"}, "title": "CISA ADP Vulnrichment"}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R08SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R16SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R32SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R120SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R16PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R32PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R120PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "all versions"}]}], "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "66D3AC7B-50E0-47D5-B0D1-07329D724EFE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "B185323A-C9E3-48A0-AD28-DA7AC7846E18", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA81D5C7-46C8-4F0E-9550-D240DC0366F3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "C4BBE066-33C4-4410-85D3-4B77B3773330", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FB53D61-6C69-4A4A-92B1-C10D0B8F0EC9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "6F6304BE-DAEE-49AB-B0B1-CEE6878CBECE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8218130C-4E7D-4FB9-976B-2351977C82D4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "515BDC46-5A1C-4A94-816A-B4751BB1B58D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A63D33D-302A-428C-986F-FC3F83CE9C86", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA37F2FC-8F75-4FEA-882D-87AD5CC1558E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FFB42739-E503-44B2-A020-0DB2B8791A81", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "17AD5875-B7D7-498B-9484-23049753133E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B1F532B-8EAF-4E66-9AF5-5EEFF5A0BC23", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "0EC2594C-6067-40BA-B8B2-AEC9B9C7922F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2C03EA2-34BF-4F86-A19C-2818788E092B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "CA3FB3E1-D7D3-424B-A207-D3C6F4365D12", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet."}, {"lang": "es", "value": "Vulnerabilidad de asignaci\u00f3n de privilegios incorrecta en Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU todas las versiones y MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU todas las versiones permite a un atacante autenticado remoto que haya iniciado sesi\u00f3n ingresa al producto como usuario no administrador para revelar las credenciales (ID de usuario y contrase\u00f1a) de un usuario con un nivel de acceso m\u00e1s bajo que el atacante mediante el env\u00edo de un paquete especialmente manipulado."}], "id": "CVE-2023-6815", "lastModified": "2026-06-17T06:51:28.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-6815", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-02-13T16:44:26.588675Z", "version": "2.0.3"}}]}, "published": "2024-02-13T07:15:46.843", "references": [{"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/vu/JVNVU95085830/index.html"}, {"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01"}, {"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/vu/JVNVU95085830/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf"}], "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "type": "Secondary"}]}