CVE-2023-1424

Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module

10.0 Critical

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSEC iQ-R Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

3.44%Up 3.3 points since May 24, 2023

What each source reports

CVE List Score used 10.0

Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module

Record: CVE-2023-1424
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

EUVDEUVD-2023-23677 10.0

Record: EUVD-2023-23677
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jrmr-8594-crxx 10.0

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in...

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution.

Record: GHSA-jrmr-8594-crxx
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

NVD 10.0

Record: CVE-2023-1424
CVSS 3.1: 10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-120
Updated: 2026-11-02

Affected products

Show 75 moreShow less

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-1424 is a critical vulnerability (CVSS 10.0) in Mitsubishi Electric Corporation Melsec Iq-f Series Fx5u-32mr/ds, published May 24, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.44%, the 89th percentile. No source names a fixed version.