CVE-2016-8370

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all versions, QJ71E71-B5, all versions, and QJ71E71-B2, all versions. Weakly encrypted passwords are transmitted to a MELSEC-Q PLC.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	Mitsubishi Electric MELSEC-Q Series Ethernet Interface Module	Mitsubishi Electric MELSEC-Q Series Ethernet Interface Module

References

http://www.securityfocus.com/bid/94632Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-336-03Mitigation, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/94632Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-16-336-03Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Feb 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-83717.3The web server in Phoenix Contact ILC PLCs can be accessed without authenticating even if the authentication mechanism is enabled.CVE-2016-83728.1An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E121 CVE-2016-83747.5An issue was discovered in Schneider Electric Magelis HMI Magelis GTO Advanced Optimum Panels, all versions, Magelis GTU Universal Panel, al CVE-2016-83754.9An issue was discovered in Becton, Dickinson and Company (BD) Alaris 8015 Point of Care (PC) unit, Version 9.5 and prior versions, and Versi CVE-2016-83766.1An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0. This non-validated redirect/non-validated for CVE-2016-83778.0An issue was discovered in Fatek Automation PLC WinProladder Version 3.11 Build 14701. A stack-based buffer overflow vulnerability exists wh CVE-2016-83789.8An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. The application's database lacks sufficient safeguards fo CVE-2016-83798.1An issue was discovered in Moxa ioLogik E1210, firmware Version V2.4 and prior, ioLogik E1211, firmware Version V2.3 and prior, ioLogik E121 CVE-2016-83807.3The web server in Phoenix Contact ILC PLCs allows access to read and write PLC variables without authentication.CVE-2016-83828.8An exploitable heap corruption vulnerability exists in the Doc_SetSummary functionality of AntennaHouse DMC HTMLFilter. A specially crafted CVE-2016-83838.8An exploitable heap corruption vulnerability exists in the Doc_GetFontTable functionality of AntennaHouse DMC HTMLFilter. A specially crafte CVE-2016-83848.8An exploitable heap corruption vulnerability exists in the DHFSummary functionality of AntennaHouse DMC HTMLFilter.