CVE-2023-3346: Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-03 · updated 2026-06-17
Weakness: CWE-120

Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in MITSUBSHI CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition and execute arbitrary code on the product by sending specially crafted packets. In addition, system reset is required for recovery.

Affected products

Mitsubishielectric C80 Firmware: all versions
Mitsubishielectric E70 Firmware: all versions
Mitsubishielectric E80 Firmware: all versions
Mitsubishielectric M70V Firmware: all versions
Mitsubishielectric M720Vs 15-Type Firmware: all versions
Mitsubishielectric M720Vs Firmware: all versions
Mitsubishielectric M720Vw Firmware: all versions
Mitsubishielectric M730Vs 15-Type Firmware: all versions
Mitsubishielectric M730Vs Firmware: all versions
Mitsubishielectric M730Vw Firmware: all versions
Mitsubishielectric M750Vs 15-Type Firmware: all versions
Mitsubishielectric M750Vs Firmware: all versions
Mitsubishielectric M750Vw Firmware: all versions
Mitsubishielectric M800S Firmware: all versions
Mitsubishielectric M800Vs Firmware: all versions
Mitsubishielectric M800Vw Firmware: all versions
Mitsubishielectric M800W Firmware: all versions
Mitsubishielectric M80 Firmware: all versions
Mitsubishielectric M80V Firmware: all versions
Mitsubishielectric M80Vw Firmware: all versions
Mitsubishielectric M80W Firmware: all versions

References

Get alerted when CVE-2023-3346 or the next vulnerability affects your stack