Skip to content
Fencer Vulns
medium 5.3

CVE-2023-7033 json

Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L…

published 2024-02-27 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-59224

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 58%
public exploits
0
none known

Summary

Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L series CPU module, MELSEC iQ-R Ethernet Interface Module, MELSEC iQ-R CC-Link IE TSN Master/Local Module, CC-Link IE TSN Remote I/O Module, CC-Link IE TSN Analog-Digital Converter Module, CC-Link IE TSN Digital-Analog Converter Module, CC-Link IE TSN - CC-Link IE Field Network Bridge Module, CC-Link IE TSN - AnyWireASLINK Bridge Module, CC-Link IE TSN FPGA Module, CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY, MELSEC iQ-R Motion Module, MELSEC iQ-L Motion Module, MELSEC iQ-F FX5 Motion Module, MELSEC iQ-F Series CPU module, MELSEC iQ-F Series Ethernet module, MELSEC iQ-F Series Ethernet/IP module, MELSEC iQ-F Series OPC UA Module, MELSEC iQ-F Series CC-Link IE TSN master/local module, GOT2000 Series CC-Link IE TSN Communication Unit, FR-A800-E series inverters, FR-F800-E series inverters, FR-E800-E series inverters, INVERTER CC-Link IE TSN Plug-in option, INVERTER CC-Link IE TSN Safety Plug-in option, INVERTER CC-Link IE TSN communication function built-in type, MR-J5 series AC Servos MELSERVO, MR-JET series AC Servos MELSERVO, MR-MD333G series AC Servos MELSERVO, MR-JE series AC Servos MELSERVO, MELSERVO-J4 AC Servos MELSERVO and Embedded Type Servo System Controller allow a remote attacker to cause a temporary Denial of Service condition for a certain period of time in Ethernet communication of the products by performing TCP SYN Flood attack.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-058-01 updated cvss 5.3

Mitsubishi Electric Multiple Factory Automation Products (Update A)

  • Mitsubishi Electric Corporation CC-Link IE TSN - AnyWireASLINK Bridge Module NZ2AW1GNAL Mitsubishi Electric Corporation CC-Link IE TSN - CC-Link IE Field Network Bridge Module NZ2GN-GFB Mitsubishi Electric Corporation CC-Link IE TSN Analog-Digital Converter Module NZ2GN2B-60AD4 Mitsubishi Electric Corporation CC-Link IE TSN Analog-Digital Converter Module NZ2GN2S-60AD4 Mitsubishi Electric Corporation CC-Link IE TSN Digital-Analog Converter Module NZ2GN2B-60DA4 Mitsubishi Electric Corporation CC-Link IE TSN Digital-Analog Converter Module NZ2GN2S-60DA4
    +34 more products
    Mitsubishi Electric Corporation CC-Link IE TSN FPGA Module NZ2GN2S- D41PD02 Mitsubishi Electric Corporation CC-Link IE TSN FPGA Module NZ2GN2S-D41D01 Mitsubishi Electric Corporation CC-Link IE TSN FPGA Module NZ2GN2S-D41P01 Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-16D Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-16T Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-16TE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32D Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32DT Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32DTE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32T Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32TE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-16D Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-16T Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-16TE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32D Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32DT Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32DTE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32T Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32TE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN12A2-16T Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN12A2-16TE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN12A4-16D Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN12A4-16DE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN12A42-16DT Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN12A42-16DTE Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GNCE3-32D Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GNCE3-32DT Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GNCF1-32D Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GNCF1-32T Mitsubishi Electric Corporation CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY NZ2GACP620-60 Mitsubishi Electric Corporation CC-Link IE TSN Remote Station Communication LSI CP620 with GbE-PHY NZ2GACP620-300 Mitsubishi Electric Corporation Embedded Type Servo System Controller MR-EM441G series Mitsubishi Electric Corporation FR-A800-E series inverters FR-A800-E series Mitsubishi Electric Corporation FR-E800-E series inverters FR-E800-E series
    affected: mitigation “Use a firewall, virtual private network (VPN) etc., to prevent unauthorized access when Internet access is required.” mitsubishielectric.com

119 more affected in the full advisory

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.85% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R00CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R01CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R02CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R04CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R08CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R16CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R32CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R120CPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R04ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R08ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R16ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R32ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R120ENCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R08SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R16SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R32SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R120SFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R08PCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R16PCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R32PCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R120PCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R08PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R16PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R32PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R series CPU module R120PSFCPU
  • Mitsubishi Electric Corporation MELSEC iQ-L series CPU module L04HCPU
  • Mitsubishi Electric Corporation MELSEC iQ-L series CPU module L08HCPU
  • Mitsubishi Electric Corporation MELSEC iQ-L series CPU module L16HCPU
  • Mitsubishi Electric Corporation MELSEC iQ-L series CPU module L32HCPU
  • Mitsubishi Electric Corporation MELSEC iQ-R Ethernet Interface Module RJ71EN71
  • Mitsubishi Electric Corporation MELSEC iQ-R CC-Link IE TSN Master/Local Module RJ71GN11-T2
  • Mitsubishi Electric Corporation MELSEC iQ-R CC-Link IE TSN Master/Local Module RJ71GN11-SX
  • Mitsubishi Electric Corporation MELSEC iQ-R CC-Link IE TSN Master/Local Module RJ71GN11-EIP
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32D
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32T
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32TE
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32DT
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-32DTE
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-16D
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-16T
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2B1-16TE
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32D
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32T
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32TE
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32DT
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-32DTE
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-16D
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-16T
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GN2S1-16TE
  • Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O Module NZ2GNCF1-32D

Classification

Weakness
  • CWE-410 Insufficient Resource Pool

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.