Is CVE-2023-6815 actively exploited?

No active exploitation of CVE-2023-6815 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-6815 be exploited remotely?

Yes. CVE-2023-6815 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-6815?

CVE-2023-6815 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2023-6815

MEDIUM

CVE-2023-6815

CWE-266Published: February 13, 2024· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all versions and MELSEC iQ-R Series SIL2 Process CPU R08/16/32/120PSFCPU all versions allows a remote authenticated attacker who has logged into the product as a non-administrator user to disclose the credentials (user ID and password) of a user with a lower access level than the attacker by sending a specially crafted packet.

NVD Source

Technical Analysis

CVE-2023-6815 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 6.5.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Vendors & Products

mitsubishielectric16 product(s)

r08sfcpu firmwarer08sfcpur16sfcpu firmwarer16sfcpur32sfcpu firmwarer32sfcpur120sfcpu firmwarer120sfcpur08psfcpu firmwarer08psfcpur16psfcpu firmwarer16psfcpu+4

Source: NVD CPE · 16 total CPE entries