Minh Pham

A missing authentication feature in the MODBUS/TCP implementation of the Mitsubishi Electric MELSEC iQ-F Series CPU module allows a remote, unauthenticated attacker to read or write device values and stop program operation. The vulnerability stems from the lack of authentication features within the MODBUS/TCP protocol used by the product.

A cleartext transmission issue exists in the Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module. A remote, unauthenticated attacker can intercept SLMP communication messages to obtain credential information. This allows the attacker to read or write device values and potentially stop program operations.

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module (affected versions not specified) Description: An improper handling of a length parameter inconsistency exists in the web server function of the product. This allows a remote, unauthenticated attacker to delay processing of the web server function and prevent legitimate users from utilizing it by sending a specially crafted HTTP request. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric MELSEC iQ-F Series (affected versions not specified) Description: The software contains an overly restrictive account lockout mechanism. A remote, unauthenticated attacker can lockout legitimate users by repeatedly attempting to log in with incorrect passwords. This prevents legitimate users from logging in for a specific duration or until the product is reset. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.