by Kastro
Paper/Archive/CVE-2023-4088

CVE-2023-4088

Mitsubishi Electric Corporation GX Works3 — Malicious Code Execution Vulnerability in FA Engineering Software Products

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
30
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 8.1.081 × 201.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

Affected

ProductAffectedFixed inSource
GX Works3all versions–CNA
AL-PCS/WIN-Eall versions–CNA
CPU Module Logging Configuration Toolall versions–CNA
EZSocketall versions–CNA
FR Configurator2all versions–CNA
FX Configurator-ENall versions–CNA
FX Configurator-EN-Lall versions–CNA
FX Configurator-FPall versions–CNA
GT Designer3 Version1(GOT1000)all versions–CNA
GT Designer3 Version1(GOT2000)all versions–CNA
GT SoftGOT1000 Version3all versions–CNA
GT SoftGOT2000 Version1all versions–CNA

Scores by source

Mitsubishi (CNA)9.3CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorymitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdfrefjvn.jp/vu/JVNVU96447193/index.htmlrefcisa.gov/news-events/ics-advisories/icsa-23-269-03