CVE-2023-4088 Malicious Code Execution Vulnerability in FA Engineering Software Products
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: Mitsubishi Electric Corporation
product: GX Works3
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: AL-PCS/WIN-E
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: CPU Module Logging Configuration Tool
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: EZSocket
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: FR Configurator2
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: FX Configurator-EN
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: FX Configurator-EN-L
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: FX Configurator-FP
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GT Designer3 Version1(GOT1000)
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GT Designer3 Version1(GOT2000)
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GT SoftGOT1000 Version3
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GT SoftGOT2000 Version1
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GX LogViewer
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: GX Works2
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MELSOFT FieldDeviceConfigurator
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MELSOFT iQ AppPortal
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MELSOFT MaiLab
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MELSOFT Navigator
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MELSOFT Update Manager
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MX Component
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: MX Sheet
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: PX Developer
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: RT ToolBox3
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: RT VisualBox
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: Data Transfer
default_status: unaffected
vendor: Mitsubishi Electric Corporation
product: Data Transfer Classic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 9.3
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-09-20T02:26:43.901Z