{"id":"CVE-2023-6815","aliases":["EUVD-2023-59025","GHSA-r5w8-hf4h-f29v"],"status":"published","title":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R...","description":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00697,"percentile":0.535,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-266"],"published":"2024-02-13T06:27:51Z","modified":"2026-06-17T06:51:28Z","products":[{"vendor":"mitsubishi electric corporation","product":"melsec iq-r series safety cpu r08sfcpu"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-r series safety cpu r120sfcpu"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-r series safety cpu r16sfcpu"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-r series safety cpu r32sfcpu"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-r series sil2 process cpu r08psfcpu"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-r series sil2 process cpu r120psfcpu"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-r series sil2 process cpu r16psfcpu"},{"vendor":"mitsubishi electric corporation","product":"melsec iq-r series sil2 process cpu r32psfcpu"},{"vendor":"mitsubishielectric","product":"r08psfcpu_firmware"},{"vendor":"mitsubishielectric","product":"r08sfcpu_firmware"},{"vendor":"mitsubishielectric","product":"r120psfcpu_firmware"},{"vendor":"mitsubishielectric","product":"r120sfcpu_firmware"},{"vendor":"mitsubishielectric","product":"r16psfcpu_firmware"},{"vendor":"mitsubishielectric","product":"r16sfcpu_firmware"},{"vendor":"mitsubishielectric","product":"r32psfcpu_firmware"},{"vendor":"mitsubishielectric","product":"r32sfcpu_firmware"}],"references":[{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-021_en.pdf","tags":["vendor-advisory","x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://jvn.jp/vu/JVNVU95085830/index.html","tags":["government-resource","x_transferred","Third Party Advisory"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-044-01","tags":["government-resource","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6815"},{"url":"https://github.com/advisories/GHSA-r5w8-hf4h-f29v"}],"sources":{"cve":[{"id":"CVE-2023-6815","description":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.","status":"published","published":"2024-02-13T06:27:51.202Z","modified":"2024-08-02T08:42:07.419Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:35:25.469654Z"}],"euvd":[{"id":"EUVD-2023-59025","description":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.","status":"published","published":"2024-02-13T06:27:51Z","modified":"2024-08-02T08:42:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:10.17189Z"}],"ghsa":[{"id":"GHSA-r5w8-hf4h-f29v","title":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R...","description":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.","status":"published","published":"2024-02-13T09:30:31Z","modified":"2024-10-22T18:33:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:58:34.272194Z"}],"nvd":[{"id":"CVE-2023-6815","description":"Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.","status":"published","published":"2024-02-13T07:15:46.843Z","modified":"2026-06-17T06:51:28.69Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:09:04.527564Z"}]}}