{"id":"CVE-2023-6374","aliases":["EUVD-2023-58615","GHSA-v334-55hv-wvc6"],"status":"published","title":"Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC...","description":"Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00755,"percentile":0.55461,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-294"],"published":"2024-01-30T09:00:14Z","modified":"2026-06-17T06:50:38Z","products":[{"vendor":"mitsubishi electric corporation","product":"melsec ws series ws0-geth00200"},{"vendor":"mitsubishielectric","product":"melsec_ws0-geth00200_firmware"}],"references":[{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-019_en.pdf","tags":["vendor-advisory","x_transferred","Vendor Advisory"]},{"url":"https://jvn.jp/vu/JVNVU99497477","tags":["government-resource","x_transferred","Third Party Advisory"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-03","tags":["government-resource","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6374"},{"url":"https://github.com/advisories/GHSA-v334-55hv-wvc6"}],"sources":{"cve":[{"id":"CVE-2023-6374","description":"Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.","status":"published","published":"2024-01-30T09:00:14.8Z","modified":"2025-06-09T18:35:44.426Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2023-58615","description":"Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.","status":"published","published":"2024-01-30T09:00:14Z","modified":"2025-06-09T18:35:44Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:27.346488Z"}],"ghsa":[{"id":"GHSA-v334-55hv-wvc6","title":"Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC...","description":"Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.","status":"published","published":"2024-01-30T09:30:34Z","modified":"2024-01-31T09:30:19Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:55:30.717237Z"}],"nvd":[{"id":"CVE-2023-6374","description":"Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers allows a remote unauthenticated attacker to bypass authentication by capture-replay attack and illegally login to the affected module. As a result, the remote attacker who has logged in illegally may be able to disclose or tamper with the programs and parameters in the modules.","status":"published","published":"2024-01-30T09:15:47.52Z","modified":"2026-06-17T06:50:38.03Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:09:04.527564Z"}]}}