{"id":"CVE-2023-4088","state":"PUBLISHED","title":"Malicious Code Execution Vulnerability in FA Engineering Software Products","description":"Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.","publishedAt":"2023-09-20T02:26:43.901Z","updatedAt":"2024-09-24T18:27:11.655Z","severity":{"score":9.3,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"Mitsubishi"},"assigner":"Mitsubishi","products":["Mitsubishi Electric Corporation GX Works3","Mitsubishi Electric Corporation AL-PCS/WIN-E","Mitsubishi Electric Corporation CPU Module Logging Configuration Tool","Mitsubishi Electric Corporation EZSocket","Mitsubishi Electric Corporation FR Configurator2","Mitsubishi Electric Corporation FX Configurator-EN","Mitsubishi Electric Corporation FX Configurator-EN-L","Mitsubishi Electric Corporation FX Configurator-FP","Mitsubishi Electric Corporation GT Designer3 Version1(GOT1000)","Mitsubishi Electric Corporation GT Designer3 Version1(GOT2000)","Mitsubishi Electric Corporation GT SoftGOT1000 Version3","Mitsubishi Electric Corporation GT SoftGOT2000 Version1","Mitsubishi Electric Corporation GX LogViewer","Mitsubishi Electric Corporation GX Works2","Mitsubishi Electric Corporation MELSOFT FieldDeviceConfigurator","Mitsubishi Electric Corporation MELSOFT iQ AppPortal","Mitsubishi Electric Corporation MELSOFT MaiLab","Mitsubishi Electric Corporation MELSOFT Navigator","Mitsubishi Electric Corporation MELSOFT Update Manager","Mitsubishi Electric Corporation MX Component","Mitsubishi Electric Corporation MX Sheet","Mitsubishi Electric Corporation PX Developer","Mitsubishi Electric Corporation RT ToolBox3","Mitsubishi Electric Corporation RT VisualBox","Mitsubishi Electric Corporation Data Transfer","Mitsubishi Electric Corporation Data Transfer Classic"],"affected":[{"vendor":"Mitsubishi Electric Corporation","product":"GX Works3","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"AL-PCS/WIN-E","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"CPU Module Logging Configuration Tool","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"EZSocket","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"FR Configurator2","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"FX Configurator-EN","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"FX Configurator-EN-L","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"FX Configurator-FP","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GT Designer3 Version1(GOT1000)","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GT Designer3 Version1(GOT2000)","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GT SoftGOT1000 Version3","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GT SoftGOT2000 Version1","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GX LogViewer","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GX Works2","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT FieldDeviceConfigurator","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT iQ AppPortal","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT MaiLab","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT Navigator","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT Update Manager","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MX Component","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MX Sheet","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"PX Developer","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"RT ToolBox3","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"RT VisualBox","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"Data Transfer","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"Data Transfer Classic","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]}],"references":["https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf","https://jvn.jp/vu/JVNVU96447193/index.html","https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03"],"weaknesses":["CWE-276"],"ingestedAt":"2026-10-29T20:06:33.064Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/4xxx/CVE-2023-4088.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-4088","state":"PUBLISHED","datePublished":"2023-09-20T02:26:43.901Z","dateUpdated":"2024-09-24T18:27:11.655Z","assignerShortName":"Mitsubishi","assignerOrgId":"e0f77b61-78fd-4786-b3fb-1ee347a748ad","dateReserved":"2023-08-02T04:52:49.923Z"},"containers":{"cna":{"title":"Malicious Code Execution Vulnerability in FA Engineering Software Products","descriptions":[{"lang":"en","value":"Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder."}],"affected":[{"vendor":"Mitsubishi Electric Corporation","product":"GX Works3","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"AL-PCS/WIN-E","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"CPU Module Logging Configuration Tool","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"EZSocket","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"FR Configurator2","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"FX Configurator-EN","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"FX Configurator-EN-L","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"FX Configurator-FP","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GT Designer3 Version1(GOT1000)","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GT Designer3 Version1(GOT2000)","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GT SoftGOT1000 Version3","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GT SoftGOT2000 Version1","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GX LogViewer","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"GX Works2","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT FieldDeviceConfigurator","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT iQ AppPortal","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT MaiLab","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT Navigator","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSOFT Update Manager","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MX Component","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MX Sheet","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"PX Developer","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"RT ToolBox3","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"RT VisualBox","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"Data Transfer","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"Data Transfer Classic","defaultStatus":"unaffected","versions":[{"version":"all versions","status":"affected"}]}],"references":[{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf","tags":["vendor-advisory"]},{"url":"https://jvn.jp/vu/JVNVU96447193/index.html","tags":["government-resource"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":9.3,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-276","description":"CWE-276 Incorrect Default Permissions","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mitsubishi","orgId":"e0f77b61-78fd-4786-b3fb-1ee347a748ad","dateUpdated":"2024-07-04T09:16:28.950Z"},"impacts":[{"descriptions":[{"lang":"en","value":"Malicious Code Execution"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf","tags":["vendor-advisory","x_transferred"]},{"url":"https://jvn.jp/vu/JVNVU96447193/index.html","tags":["government-resource","x_transferred"]},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03","tags":["government-resource","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T07:17:12.060Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-24T18:27:00.307770Z","id":"CVE-2023-4088","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-24T18:27:11.655Z"}}]}}}