« Volver al listado

CVE-2024-8403

Estado: AplazadaAlta (7.5)—

Improper Validation of Specified Type of Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET versions 1.100 to 1.200 and FX5-ENET/IP versions 1.100 to 1.104 allows a remote attacker to cause a Denial of Service condition in Ethernet communication of the products by sending specially crafted SLMP packets.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS AV:N/PR:N/UI:N indica acceso remoto sin privilegios (T1190). Descripción explícita de DoS mediante paquetes SLMP manipulados causa negación de servicio en comunicaciones Ethernet (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mitsubishi Electric Corporation — Melsec Iq-f Series Fx5-enetAIMitsubishi Electric Corporation — Melsec Iq-f Series Fx5-enet IPAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8403",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8403",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-19T14:22:12.749274Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "affectedData": [
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "MELSEC iQ-F Series FX5-ENET",
          "versions": [
            {
              "status": "affected",
              "version": "1.100 to 1.200"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Mitsubishi Electric Corporation",
          "product": "MELSEC iQ-F Series FX5-ENET/IP",
          "versions": [
            {
              "status": "affected",
              "version": "1.100 to 1.104"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:mitsubishi_electric:melsec_iq-f_series_fx5-enet:*:*:*:*:*:*:*:*"
          ],
          "vendor": "mitsubishi_electric",
          "product": "melsec_iq-f_series_fx5-enet",
          "versions": [
            {
              "status": "affected",
              "version": "1.100",
              "versionType": "custom",
              "lessThanOrEqual": "*"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:h:mitsubishi_electric:melsec_iq-f_series_fx5-enet_ip:*:*:*:*:*:*:*:*"
          ],
          "vendor": "mitsubishi_electric",
          "product": "melsec_iq-f_series_fx5-enet_ip",
          "versions": [
            {
              "status": "affected",
              "version": "1.100",
              "versionType": "custom",
              "lessThanOrEqual": "1.104"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-19T06:15:17.873",
  "references": [
    {
      "url": "https://jvn.jp/vu/JVNVU97790713/",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-324-01",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    },
    {
      "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2024-009_en.pdf",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Validation of Specified Type of Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET versions 1.100 to 1.200 and FX5-ENET/IP versions 1.100 to 1.104 allows a remote attacker to cause a Denial of Service condition in Ethernet communication of the products by sending specially crafted SLMP packets."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de validación incorrecta del tipo de entrada especificado en Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET versiones 1.100 y posteriores y FX5-ENET/IP versiones 1.100 a 1.104 permite a un atacante remoto provocar una condición de denegación de servicio en la comunicación Ethernet de los productos mediante el envío de paquetes SLMP especialmente manipulados."
    }
  ],
  "lastModified": "2026-06-17T08:22:30.997",
  "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
}