Mitsubishi MELSEC iQ-R/iQ-F EtherNet/IP authentication bypass
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple authentication flaws in Mitsubishi MELSEC iQ-R and iQ-F EtherNet/IP modules allow unauthenticated remote FTP access; no active exploitation reported.
Mitsubishi Electric has disclosed four authentication and access-control vulnerabilities affecting MELSEC iQ-R and iQ-F EtherNet/IP modules and their configuration tools. The flaws include weak password requirements (CVE-2023-2060), hard-coded credentials (CVE-2023-2061), unmasked passwords in configuration software (CVE-2023-2062), and unrestricted file upload via FTP (CVE-2023-2063). Successful exploitation allows remote unauthenticated attackers to connect to affected modules via FTP, bypass authentication, and potentially modify or delete configuration files. The vulnerabilities affect RJ71EIP91 (all versions), FX5-ENET/IP (all versions), and SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD (version 1.01B and prior). CISA reports no known public exploitation as of the advisory date.
Mitigations vary by product. For RJ71EIP91 firmware version "06" or later, disable FTP and restrict connections via the EtherNet/IP Configuration Tool. FX5-ENET/IP has no fixed version planned; Mitsubishi recommends replacement with FX5-EIP or use of IP filtering and FTP disabling on firmware 1.106 and later. Configuration tool versions SW1DNN-EIPCT-BD and SW1DNN-EIPCTFX5-BD should be updated to version 1.02C or later. General mitigations include network segmentation, VPN access restriction, firewall blocking, and avoiding direct FTP file transfer.
Mentioned in this report
Detection guidance
Scripting or CLI Client Opening FTP Session to Internal Host
Detects command-line or scripting processes (ftp.exe, PowerShell, curl, Python, cmd) initiating outbound FTP (TCP/21) to private addresses. Relevant to unauthenticated or default-credential FTP access to ICS modules such as the MELSEC iQ-R/iQ-F EtherNet/IP modules (CVE-2023-2061, CVE-2023-2063). Best scoped to hosts outside the engineering workstation group. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripting or CLI Client Opening FTP Session to Internal Host
description: Detects command-line or scripting processes (ftp.exe, PowerShell, curl,
Python, cmd) initiating outbound FTP on TCP/21 to private address space. Relevant
to unauthenticated or default-credential FTP access to ICS modules such as MELSEC
EtherNet/IP modules. Scope to hosts outside the engineering workstation group.
tags:
- attack.initial-access
- attack.t1190
- attack.t1078.001
- attack.t1199
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 21
DestinationIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
Image|endswith:
- \ftp.exe
- \powershell.exe
- \pwsh.exe
- \curl.exe
- \python.exe
- \cmd.exe
- \wscript.exe
- \cscript.exe
condition: selection
falsepositives:
- Administrators or backup scripts using ftp.exe or curl to transfer files to internal
FTP servers
- Engineering workstations legitimately scripting file transfers to PLC modules
level: medium
id: 46bc533d-3d52-5b74-bc94-f84a9d430125
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-02
Scripted FTP Upload or Delete via Native Tools
Detects ftp.exe running a script file, or curl/PowerShell performing FTP upload or delete operations. This matches the file upload/delete abuse of unauthenticated FTP on affected PLC modules (CVE-2023-2063). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripted FTP Upload or Delete via Native Tools
description: Detects ftp.exe running a command script (-s:), or curl/PowerShell performing
FTP uploads or deletions. Matches abuse of FTP on exposed industrial modules to
modify or delete configuration files.
tags:
- attack.initial-access
- attack.t1190
- attack.t1078.001
logsource:
category: process_creation
product: windows
detection:
selection_ftp:
Image|endswith: \ftp.exe
CommandLine|contains: '-s:'
selection_curl:
Image|endswith: \curl.exe
CommandLine|contains: ftp://
selection_curl_action:
CommandLine|contains:
- ' -T '
- --upload-file
- DELE
selection_ps:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains|all:
- ftp://
- UploadFile
condition: selection_ftp or (selection_curl and selection_curl_action) or selection_ps
falsepositives:
- Legacy automation scripts that push files to internal FTP servers
- Administrators uploading firmware or configuration files to devices by FTP
level: medium
id: af220b17-2c3e-5341-b838-d911300940e6
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-23-157-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs