CVE-2023-0457

Information Disclosure Vulnerability in MELSEC Series

7.5 High

Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.17%Unchanged since Mar 3, 2023

What each source reports

CVE List Score used 7.5

Information Disclosure Vulnerability in MELSEC Series

Record: CVE-2023-0457
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-256
Updated: 2026-11-02

EUVDEUVD-2023-12511 7.5

Record: EUVD-2023-12511
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wmp3-7qc8-4x9f 7.5

Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F...

Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U(C) CPU modules all models all versions, FX5UJ CPU modules all models all versions, FX5S CPU modules all models all versions, FX5-ENET all versions and FX5-ENET/IP all versions allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.

Record: GHSA-wmp3-7qc8-4x9f
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-256, CWE-522
Updated: 2026-11-02

NVD 7.5

Record: CVE-2023-0457
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-256, CWE-522
Updated: 2026-11-02

Affected products

Show 137 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-0457 is a high vulnerability (CVSS 7.5) in Mitsubishi Electric Corporation Melsec Iq-f Series Fx5-enet, published March 3, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. No source names a fixed version.