Mitsubishi Electric MELSEC Flaws Expose Industrial Controllers to RCE and DoS

CISA issued advisories for multiple vulnerabilities affecting Mitsubishi Electric MELSEC industrial automation products used in the Critical Manufacturing sector, including MELSEC PLC families, motion modules, CNC series, and MELSEC-F Series Ethernet modules. The most severe issue, CVE-2023-4699, is a missing authentication flaw (CWE-306) in Mitsubishi Electric proprietary protocol communications that can let a remote attacker send specially crafted packets to execute arbitrary commands; CISA rated it CVSS 10.0 and said the update expanded the list of affected products and revised mitigations and scoring.

A separate advisory covers CVE-2021-20613, an improper initialization flaw in MELSEC-F Series Ethernet modules including FX3U-ENET, FX3U-ENET-L, and FX3U-ENET-P502 running firmware 1.16 or earlier. That vulnerability can be exploited remotely with low attack complexity to trigger a denial-of-service condition in communications that requires a system reset, and Mitsubishi Electric released firmware 1.17 or later to fix it. Across both advisories, CISA and Mitsubishi Electric urged operators to isolate control networks, restrict access with firewalls or VPNs, apply IP filtering, keep devices on trusted LANs, and limit physical and remote exposure; neither advisory reported known public exploitation targeting the flaws.