Authentication Bypass Vulnerability in MELSEC-F Series main module

Description

Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series main modules allows a remote unauthenticated attacker to cancel the password/keyword setting and login to the affected products by sending specially crafted packets.

Scores

EPSS (exploitation in 30 days)

1.3% · top 29% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-294 Authentication Bypass by Capture-replay (opens in a new tab)All about CWE-294 and its CVEs

Affected products

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-48MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-48MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-48MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-80MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-80MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-80MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-128MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-128MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-128MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-48MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-48MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-48MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-80MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-80MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-80MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MR/UA1

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MR/UA1

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MS/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MS/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-32MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-48MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-48MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-64MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-80MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-80MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-128MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3U-128MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-16MT/D

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-32MT/D

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-64MT/D

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-96MT/D

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-16MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-32MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-64MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-96MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-16MR/D-T

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-16MR/DS-T

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-32MT-LT

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-32MT-LT-2

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-16MT/D-P4

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3UC-16MT/DSS-P4

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-14MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-14MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-14MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-24MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-24MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-24MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-40MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-40MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-40MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-60MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-60MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-60MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-14MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-14MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-14MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-24MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-24MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-24MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-40MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-40MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-40MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-60MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-60MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-60MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-14MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-14MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-24MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-24MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-40MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-40MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-60MR/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3G-60MT/ES-A

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GC-32MT/D

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GC-32MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-24MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-24MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-24MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-40MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-40MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-40MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-24MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-24MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-24MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-40MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-40MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GE-40MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GA-24MR-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GA-24MT-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GA-40MR-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GA-40MT-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GA-60MR-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3GA-60MT-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-10MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-10MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-10MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-10MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-10MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-10MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-14MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-14MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-14MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-14MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-14MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-14MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-20MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-20MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-20MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-20MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-20MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-20MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MR/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MR/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MT/DS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MT/DSS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MT/ES

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MT/ESS

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MR/ES-2AD

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MT/ES-2AD

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3S-30MT/ESS-2AD

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3SA-10MR-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3SA-10MT-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3SA-14MR-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3SA-14MT-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3SA-20MR-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3SA-20MT-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3SA-30MR-CM

  • affected all versions

• Mitsubishi Electric Corporation · MELSEC-F Series FX3SA-30MT-CM

  • affected all versions

References (3)

• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-005_en.pdf (opens in a new tab)x_transferred
• https://jvn.jp/vu/JVNVU94519952 (opens in a new tab)x_transferred
• https://www.cisa.gov/news-events/ics-advisories/icsa-23-180-04 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-2846](https://trackcve.app/badge/CVE-2023-2846.svg)](https://trackcve.app/cve/CVE-2023-2846)

Record last updated 5 Mar 2025, 18:55 UTC.