What is the CVSS score of CVE-2023-4625?

CVE-2023-4625 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.9%.

Fx5U 32Mt Es Firmware CVE-2023-4625

MEDIUM

Improper Restriction of Excessive Authentication Attempts (CWE-307)

2023-11-06 Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

Authentication Bypass Fx5U 32Mt Es Firmware Fx5U 64Mt Es Firmware Fx5U 80Mt Es Firmware Fx5U 32Mr Es Firmware Fx5U 64Mr Es Firmware Fx5U 80Mr Es Firmware Fx5U 32Mt Ds Firmware Fx5U 64Mt Ds Firmware Fx5U 80Mt Ds Firmware Fx5U 32Mr Ds Firmware Fx5U 64Mr Ds Firmware Fx5U 80Mr Ds Firmware Fx5U 32Mt Ess Firmware Fx5U 64Mt Ess Firmware Fx5U 80Mt Ess Firmware Fx5U 32Mt Dss Firmware Fx5U 64Mt Dss Firmware Fx5U 80Mt Dss Firmware Fx5Uc 32Mt D Firmware Fx5Uc 64Mt D Firmware Fx5Uc 96Mt D Firmware Fx5Uc 32Mt Dss Firmware Fx5Uc 64Mt Dss Firmware Fx5Uc 96Mt Dss Firmware Fx5Uc 32Mt Ds Ts Firmware Fx5Uc 32Mt Dss Ts Firmware Fx5Uc 32Mr Ds Ts Firmware Fx5Uj 24Mt Es Firmware Fx5Uj 40Mt Es Firmware Fx5Uj 60Mt Es Firmware Fx5Uj 24Mr Es Firmware Fx5Uj 40Mr Es Firmware Fx5Uj 60Mr Es Firmware Fx5Uj 24Mt Ess Firmware Fx5Uj 40Mt Ess Firmware Fx5Uj 60Mt Ess Firmware Fx5Uj 24Mt Ds Firmware Fx5Uj 40Mt Ds Firmware Fx5Uj 60Mt Ds Firmware Fx5Uj 24Mr Ds Firmware Fx5Uj 40Mr Ds Firmware Fx5Uj 60Mr Ds Firmware Fx5Uj 24Mt Dss Firmware Fx5Uj 40Mt Dss Firmware Fx5Uj 60Mt Dss Firmware Fx5Uj 24Mt Es A Firmware Fx5Uj 40Mt Es A Firmware Fx5Uj 60Mt Es A Firmware Fx5Uj 24Mr Es A Firmware Fx5Uj 40Mr Es A Firmware Fx5Uj 60Mr Es A Firmware Fx5S 30Mt Es Firmware Fx5S 40Mt Es Firmware Fx5S 60Mt Es Firmware Fx5S 80Mt Es Firmware Fx5S 30Mr Es Firmware Fx5S 40Mr Es Firmware Fx5S 60Mr Es Firmware Fx5S 80Mr Es Firmware Fx5S 30Mt Ess Firmware Fx5S 40Mt Ess Firmware Fx5S 60Mt Ess Firmware Fx5S 80Mt Ess Firmware

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

CVE Published

Nov 06, 2023 - 05:15 nvd

MEDIUM 5.3

DescriptionNVD

Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.

AnalysisAI

Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-307. Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login. Affected products include: Mitsubishielectric Fx5U-32Mt\/Es Firmware, Mitsubishielectric Fx5U-64Mt\/Es Firmware, Mitsubishielectric Fx5U-80Mt\/Es Firmware, Mitsubishielectric Fx5U-32Mr\/Es Firmware, Mitsubishielectric Fx5U-64Mr\/Es Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.