CVE-2023-6815

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-266

Affected software

Vendor	Product	Versions
Mitsubishi Electric Corporation	MELSEC iQ-R Series Safety CPU R08SFCPU	all versions
Mitsubishi Electric Corporation	MELSEC iQ-R Series Safety CPU R16SFCPU	all versions
Mitsubishi Electric Corporation	MELSEC iQ-R Series Safety CPU R32SFCPU	all versions
Mitsubishi Electric Corporation	MELSEC iQ-R Series Safety CPU R120SFCPU	all versions
Mitsubishi Electric Corporation	MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU	all versions
Mitsubishi Electric Corporation	MELSEC iQ-R Series SIL2 Process CPU R16PSFCPU	all versions
Mitsubishi Electric Corporation	MELSEC iQ-R Series SIL2 Process CPU R32PSFCPU	all versions
Mitsubishi Electric Corporation	MELSEC iQ-R Series SIL2 Process CPU R120PSFCPU	all versions

References

https://jvn.jp/vu/JVNVU95085830/index.htmlThird Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01Third Party Advisory, US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdfMitigation, Vendor Advisory
https://jvn.jp/vu/JVNVU95085830/index.htmlThird Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01Third Party Advisory, US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdfMitigation, Vendor Advisory

Timeline

Published: Feb 13, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-68169.8A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. B CVE-2023-68177.8A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. CVE-2023-68216.5The Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and downl CVE-2023-68246.5The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any u CVE-2023-68259.9The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7 CVE-2023-68267.2The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'import_action' funct CVE-2023-68278.8The Essential Real Estate plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the 'ajax CVE-2023-68286.1The Contact Form, Survey & Popup Form Plugin for WordPress – ARForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site S CVE-2023-68306.1The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows u CVE-2023-68318.1Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.CVE-2023-68324.3Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.CVE-2023-68334.4Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator allows local users to gain sensitive info