Threat database

CVE-2023-4699 is a critical vulnerability affecting multiple Mitsubishi Electric MELSEC series CPU modules and CNC systems. It involves missing authentication for critical functions, allowing remote unauthenticated attackers to send specially crafted packets to execute arbitrary commands. This can lead to unauthorized disclosure or tampering of control programs and potentially cause denial-of-service by resetting devices to factory settings. The vulnerability affects all versions of the listed products and has a CVSS score of 10. Exploitation requires no authentication or user interaction and can impact confidentiality, integrity, and availability. No known exploits are currently reported in the wild. European industrial environments using these Mitsubishi Electric products are at significant risk, especially in manufacturing and critical infrastructure sectors. Immediate mitigation involves network segmentation, strict access controls, and monitoring for anomalous traffic targeting these devices.