Log in Start free

Vulnerability · Published Sep 20, 2023 · Assigned by Mitsubishi

CVE-2023-4088Malicious Code Execution Vulnerability in FA Engineering Software Products

Critical 9.3

In plain English

A critical-severity incorrect default permissions in AL-PCS/WIN-E from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)9.3Critical
Exploit odds (30 days)0.2%top 91.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation GX Works3 all versions
Mitsubishi Electric Corporation AL-PCS/WIN-E all versions
Mitsubishi Electric Corporation CPU Module Logging Configuration Tool all versions
Mitsubishi Electric Corporation EZSocket all versions
Mitsubishi Electric Corporation FR Configurator2 all versions
Mitsubishi Electric Corporation FX Configurator-EN all versions
Mitsubishi Electric Corporation FX Configurator-EN-L all versions
Mitsubishi Electric Corporation FX Configurator-FP all versions
Mitsubishi Electric Corporation GT Designer3 Version1(GOT1000) all versions
Mitsubishi Electric Corporation GT Designer3 Version1(GOT2000) all versions
Mitsubishi Electric Corporation GT SoftGOT1000 Version3 all versions
Mitsubishi Electric Corporation GT SoftGOT2000 Version1 all versions
Mitsubishi Electric Corporation GX LogViewer all versions
Mitsubishi Electric Corporation GX Works2 all versions
Mitsubishi Electric Corporation MELSOFT FieldDeviceConfigurator all versions
Mitsubishi Electric Corporation MELSOFT iQ AppPortal all versions
Mitsubishi Electric Corporation MELSOFT MaiLab all versions
Mitsubishi Electric Corporation MELSOFT Navigator all versions
Mitsubishi Electric Corporation MELSOFT Update Manager all versions
Mitsubishi Electric Corporation MX Component all versions
Mitsubishi Electric Corporation MX Sheet all versions
Mitsubishi Electric Corporation PX Developer all versions
Mitsubishi Electric Corporation RT ToolBox3 all versions
Mitsubishi Electric Corporation RT VisualBox all versions
Mitsubishi Electric Corporation Data Transfer all versions
Mitsubishi Electric Corporation Data Transfer Classic all versions

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References