Malicious Code Execution Vulnerability in FA Engineering Software Products

published 2023-09-20 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53978

cvss: 9.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-269-03 updated 2024-07-09 cvss 9.3

Mitsubishi Electric FA Engineering Software (Update A)

Mitsubishi Electric AL-PCS/WIN-E
affected: mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” mitsubishielectric.com
Mitsubishi Electric CPU Module Logging Configuration Tool Mitsubishi Electric Data Transfer
affected: vendor fix, mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” cve.mitre.org
Mitsubishi Electric Data Transfer Classic
affected: mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” mitsubishielectric.com
Mitsubishi Electric EZSocket Mitsubishi Electric FR Configurator2
affected: vendor fix, mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” cve.mitre.org
Mitsubishi Electric FX Configurator-EN Mitsubishi Electric FX Configurator-EN-L Mitsubishi Electric FX Configurator-FP Mitsubishi Electric GT Designer3 Version1(GOT1000)
affected: mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” mitsubishielectric.com
Mitsubishi Electric GT Designer3 Version1(GOT2000) Mitsubishi Electric GT SoftGOT1000 Version3 Mitsubishi Electric GT SoftGOT2000 Version1 Mitsubishi Electric GX LogViewer Mitsubishi Electric GX Works2 Mitsubishi Electric GX Works3

+1 more productsfewer

Mitsubishi Electric MELSOFT FieldDeviceConfigurator

affected: vendor fix, mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” cve.mitre.org
Mitsubishi Electric MELSOFT iQ AppPortal Mitsubishi Electric MELSOFT MaiLab
affected: mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” mitsubishielectric.com
Mitsubishi Electric MELSOFT Navigator
affected: vendor fix, mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” cve.mitre.org

show 5 more

Mitsubishi Electric MELSOFT Update Manager
affected: mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” mitsubishielectric.com
Mitsubishi Electric MX Component
affected: vendor fix, mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” cve.mitre.org
Mitsubishi Electric MX Sheet Mitsubishi Electric PX Developer
affected: mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” mitsubishielectric.com
Mitsubishi Electric RT ToolBox3
affected: vendor fix, mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” cve.mitre.org
Mitsubishi Electric RT VisualBox
affected: mitigation “Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-09-24)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	9.3	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Mitsubishi Electric Corporation GX Works3
Mitsubishi Electric Corporation AL-PCS/WIN-E
Mitsubishi Electric Corporation CPU Module Logging Configuration Tool
Mitsubishi Electric Corporation EZSocket
Mitsubishi Electric Corporation FR Configurator2
Mitsubishi Electric Corporation FX Configurator-EN
Mitsubishi Electric Corporation FX Configurator-EN-L
Mitsubishi Electric Corporation FX Configurator-FP
Mitsubishi Electric Corporation GT Designer3 Version1(GOT1000)
Mitsubishi Electric Corporation GT Designer3 Version1(GOT2000)
Mitsubishi Electric Corporation GT SoftGOT1000 Version3
Mitsubishi Electric Corporation GT SoftGOT2000 Version1
Mitsubishi Electric Corporation GX LogViewer
Mitsubishi Electric Corporation GX Works2
Mitsubishi Electric Corporation MELSOFT FieldDeviceConfigurator
Mitsubishi Electric Corporation MELSOFT iQ AppPortal
Mitsubishi Electric Corporation MELSOFT MaiLab
Mitsubishi Electric Corporation MELSOFT Navigator
Mitsubishi Electric Corporation MELSOFT Update Manager
Mitsubishi Electric Corporation MX Component
Mitsubishi Electric Corporation MX Sheet
Mitsubishi Electric Corporation PX Developer
Mitsubishi Electric Corporation RT ToolBox3
Mitsubishi Electric Corporation RT VisualBox
Mitsubishi Electric Corporation Data Transfer
Mitsubishi Electric Corporation Data Transfer Classic

Classification

Weakness

CWE-276 Incorrect Default Permissions

References

mitsubishielectric.com /en/psirt/vulnerability/pdf/2023-010_en.pdf
vendor-advisory
jvn.jp /vu/JVNVU96447193/index.html
government-resource
cisa.gov /news-events/ics-advisories/icsa-23-269-03
government-resource

Sources

CVE List CVE-2023-4088
NVD CVE-2023-4088

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary