Skip to main content

Fx5 Enet Ip Firmware CVE-2023-2061

HIGH
Use of Hard-coded Password (CWE-259)
2023-06-02 Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Authentication Bypass Fx5 Enet Ip Firmware Sw1Dnn Eipct Bd Firmware Rj71Eip91 Firmware Sw1Dnn Eipctfx5 Bd Firmware
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jun 02, 2023 - 05:15 nvd
HIGH 7.5

DescriptionNVD

Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP.

AnalysisAI

Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-259. Use of Hard-coded Password vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP allows a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP. Affected products include: Mitsubishielectric Fx5-Enet\/Ip Firmware, Mitsubishielectric Sw1Dnn-Eipct-Bd Firmware, Mitsubishielectric Rj71Eip91 Firmware, Mitsubishielectric Sw1Dnn-Eipctfx5-Bd Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Fx5 Enet Ip Firmware

View all
CVE-2020-16226 CRITICAL
9.8 Oct 05

Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, whic
CVE-2023-2060 HIGH
7.5 Jun 02

Weak Password Requirements vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC iQ-R Series EtherNet/
CVE-2023-0457 HIGH
7.5 Mar 03

Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series,
CVE-2023-2063 HIGH
7.3 Jun 02

Unrestricted Upload of File with Dangerous Type vulnerability in FTP function on Mitsubishi Electric Corporation MELSEC

CVE-2023-2062 MEDIUM
6.2 Jun 02

Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-E

Same weakness CWE-259 – Use of Hard-coded Password

View all
CVE-2025-57788 MEDIUM POC
6.9
CVE-2012-5862 CRITICAL POC
10.0
CVE-2024-42639 CRITICAL POC
9.8
CVE-2024-36526 CRITICAL POC
9.8
CVE-2024-38902 CRITICAL POC
9.8
CVE-2023-5222 CRITICAL POC
9.8
CVE-2023-3237 CRITICAL POC
9.8
CVE-2023-2645 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2023-2061 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy