Most recent entries from all

bdu:2023-03185

EUVD-2026-220681

fkie_cve-2023-2062

Missing Password Field Masking vulnerability in Mitsubishi Electric Corporation EtherNet/IP configuration tools SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD allows a remote unauthenticated attacker to know the password for MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP. This vulnerability results in authentication bypass vulnerability, which allows the attacker to access MELSEC iQ-R Series EtherNet/IP module RJ71EIP91 and MELSEC iQ-F Series EtherNet/IP module FX5-ENET/IP via FTP.

GHSA-5h4v-fjx7-95cq

gsd-2023-2062

ICSA-23-157-02 — Mitsubishi Electric MELSEC iQ-R Series/iQ-F Series (Update C)

An authentication bypass vulnerability in FTP function in the EtherNet/IP module caused by weak password requirements may allow a remote unauthenticated attacker to access to the module via FTP by a dictionary attack or password sniffing. An authentication bypass vulnerability in the FTP function in the EtherNet/IP module caused by the use of hard-coded credentials may allow a remote unauthenticated attacker to obtain a hard-coded password and access to the module via FTP. The EtherNet/IP configuration tool displays an unmasked password due to the lack of password field masking may allow a remote unauthenticated attacker to access the module via FTP. An information disclosure, tampering, deletion, destruction vulnerability exists in the FTP function in the EtherNet/IP module via a file upload/download due to unrestricted upload of file with dangerous type.