{"id":"CVE-2023-3346","aliases":["EUVD-2023-44014","GHSA-whh9-m2fc-3q2v"],"status":"published","title":"Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.02095,"percentile":0.81791,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-120"],"published":"2023-08-03T04:00:43Z","modified":"2026-06-17T06:13:51Z","products":[{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc c80 series c80"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc e70 series e70"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc e80 series e80"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc iot unit data acquisition unit"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc iot unit remote service gateway unit"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m700v series m720vs"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m700v series m720vw"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m700v series m730vs"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m700v series m730vw"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m700v series m750vs"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m700v series m750vw"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m70v series m70v"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m80 series m80"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m80 series m80w"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m800 series m800s"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m800 series m800w"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m800v series m800vs"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m800v series m800vw"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m80v series m80v"},{"vendor":"mitsubishi electric corporation","product":"mitsubishi cnc m80v series m80vw"},{"vendor":"mitsubishielectric","product":"c80_firmware"},{"vendor":"mitsubishielectric","product":"e70_firmware"},{"vendor":"mitsubishielectric","product":"e80_firmware"},{"vendor":"mitsubishielectric","product":"m70v_firmware"},{"vendor":"mitsubishielectric","product":"m720vs_15-type_firmware"},{"vendor":"mitsubishielectric","product":"m720vs_firmware"},{"vendor":"mitsubishielectric","product":"m720vw_firmware"},{"vendor":"mitsubishielectric","product":"m730vs_15-type_firmware"},{"vendor":"mitsubishielectric","product":"m730vs_firmware"},{"vendor":"mitsubishielectric","product":"m730vw_firmware"},{"vendor":"mitsubishielectric","product":"m750vs_15-type_firmware"},{"vendor":"mitsubishielectric","product":"m750vs_firmware"},{"vendor":"mitsubishielectric","product":"m750vw_firmware"},{"vendor":"mitsubishielectric","product":"m800s_firmware"},{"vendor":"mitsubishielectric","product":"m800vs_firmware"},{"vendor":"mitsubishielectric","product":"m800vw_firmware"},{"vendor":"mitsubishielectric","product":"m800w_firmware"},{"vendor":"mitsubishielectric","product":"m80_firmware"},{"vendor":"mitsubishielectric","product":"m80v_firmware"},{"vendor":"mitsubishielectric","product":"m80vw_firmware"},{"vendor":"mitsubishielectric","product":"m80w_firmware"}],"references":[{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-007_en.pdf","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://jvn.jp/vu/JVNVU90352157/index.html","tags":["government-resource","x_transferred","Third Party Advisory"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-208-03","tags":["government-resource","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3346"},{"url":"https://github.com/advisories/GHSA-whh9-m2fc-3q2v"}],"sources":{"cve":[{"id":"CVE-2023-3346","title":"Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.","status":"published","published":"2023-08-03T04:00:43.294Z","modified":"2024-12-04T15:16:48.71Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-44014","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.","status":"published","published":"2023-08-03T04:00:43Z","modified":"2024-12-04T15:16:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:41.381577Z"}],"ghsa":[{"id":"GHSA-whh9-m2fc-3q2v","title":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI...","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.","status":"published","published":"2023-08-03T06:30:23Z","modified":"2024-04-04T06:30:34Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:56:43.202556Z"}],"nvd":[{"id":"CVE-2023-3346","description":"Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.","status":"published","published":"2023-08-03T05:15:10.603Z","modified":"2026-06-17T06:13:51.9Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:08:20.798312Z"}]}}