Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2023-4088

Summary
Assigner-Mitsubishi
Assigner Org ID-e0f77b61-78fd-4786-b3fb-1ee347a748ad
Published At-20 Sep, 2023 | 02:26
Updated At-24 Sep, 2024 | 18:27
Rejected At-
Credits

Malicious Code Execution Vulnerability in FA Engineering Software Products

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Mitsubishi
Assigner Org ID:e0f77b61-78fd-4786-b3fb-1ee347a748ad
Published At:20 Sep, 2023 | 02:26
Updated At:24 Sep, 2024 | 18:27
Rejected At:
▼CVE Numbering Authority (CNA)
Malicious Code Execution Vulnerability in FA Engineering Software Products

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

Affected Products
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
GX Works3
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
AL-PCS/WIN-E
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
CPU Module Logging Configuration Tool
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
EZSocket
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
FR Configurator2
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
FX Configurator-EN
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
FX Configurator-EN-L
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
FX Configurator-FP
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
GT Designer3 Version1(GOT1000)
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
GT Designer3 Version1(GOT2000)
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
GT SoftGOT1000 Version3
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
GT SoftGOT2000 Version1
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
GX LogViewer
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
GX Works2
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
MELSOFT FieldDeviceConfigurator
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
MELSOFT iQ AppPortal
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
MELSOFT MaiLab
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
MELSOFT Navigator
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
MELSOFT Update Manager
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
MX Component
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
MX Sheet
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
PX Developer
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
RT ToolBox3
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
RT VisualBox
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
Data Transfer
Default Status
unaffected
Versions
Affected
  • all versions
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
Data Transfer Classic
Default Status
unaffected
Versions
Affected
  • all versions
Problem Types
TypeCWE IDDescription
CWECWE-276CWE-276 Incorrect Default Permissions
Type: CWE
CWE ID: CWE-276
Description: CWE-276 Incorrect Default Permissions
Metrics
VersionBase scoreBase severityVector
3.19.3CRITICAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Version: 3.1
Base score: 9.3
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
N/AMalicious Code Execution
CAPEC ID: N/A
Description: Malicious Code Execution
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
vendor-advisory
https://jvn.jp/vu/JVNVU96447193/index.html
government-resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
government-resource
Hyperlink: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
Resource:
vendor-advisory
Hyperlink: https://jvn.jp/vu/JVNVU96447193/index.html
Resource:
government-resource
Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
Resource:
government-resource
▼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
vendor-advisory
x_transferred
https://jvn.jp/vu/JVNVU96447193/index.html
government-resource
x_transferred
https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
government-resource
x_transferred
Hyperlink: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
Resource:
vendor-advisory
x_transferred
Hyperlink: https://jvn.jp/vu/JVNVU96447193/index.html
Resource:
government-resource
x_transferred
Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
Resource:
government-resource
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Published At:20 Sep, 2023 | 03:15
Updated At:04 Jul, 2024 | 10:15

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Secondary3.19.3CRITICAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Type: Primary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 9.3
Base severity: CRITICAL
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CPE Matches

Mitsubishi Electric Corporation
mitsubishielectric
>>gx_works3>>*
cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-276Primarynvd@nist.gov
CWE-276SecondaryMitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
CWE ID: CWE-276
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-276
Type: Secondary
Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://jvn.jp/vu/JVNVU96447193/index.htmlMitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
N/A
https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
N/A
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdfMitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Vendor Advisory
Hyperlink: https://jvn.jp/vu/JVNVU96447193/index.html
Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Resource: N/A
Hyperlink: https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Resource: N/A
Hyperlink: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

0Records found

Details not found