SARA / Free Tools / CVE / CVE-2023-4088

CVE-2023-4088 — Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation m

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) c

CVSS
9.3 CRITICAL
EPSS
0.03% (top 93.30%)
CWE
CWE-276
Published
2023-09-20T02:26:43.901Z
Last modified
2024-09-24T18:27:11.655Z
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

01What is this vulnerability?

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

02Affected products

VendorProductVersions
Mitsubishi Electric CorporationGX Works3all versions
Mitsubishi Electric CorporationALPCS/WIN-E — all versions
Mitsubishi Electric CorporationCPU Module Logging Configuration Toolall versions
Mitsubishi Electric CorporationEZSocketall versions
Mitsubishi Electric CorporationFR Configurator2all versions
Mitsubishi Electric CorporationFX ConfiguratorEN — all versions
Mitsubishi Electric CorporationFX ConfiguratorEN-L — all versions
Mitsubishi Electric CorporationFX ConfiguratorFP — all versions
Mitsubishi Electric CorporationGT Designer3 Version1(GOT1000)all versions
Mitsubishi Electric CorporationGT Designer3 Version1(GOT2000)all versions
Mitsubishi Electric CorporationGT SoftGOT1000 Version3all versions
Mitsubishi Electric CorporationGT SoftGOT2000 Version1all versions
Mitsubishi Electric CorporationGX LogViewerall versions
Mitsubishi Electric CorporationGX Works2all versions
Mitsubishi Electric CorporationMELSOFT FieldDeviceConfiguratorall versions
Mitsubishi Electric CorporationMELSOFT iQ AppPortalall versions
Mitsubishi Electric CorporationMELSOFT MaiLaball versions
Mitsubishi Electric CorporationMELSOFT Navigatorall versions
Mitsubishi Electric CorporationMELSOFT Update Managerall versions
Mitsubishi Electric CorporationMX Componentall versions
Mitsubishi Electric CorporationMX Sheetall versions
Mitsubishi Electric CorporationPX Developerall versions
Mitsubishi Electric CorporationRT ToolBox3all versions
Mitsubishi Electric CorporationRT VisualBoxall versions
Mitsubishi Electric CorporationData Transferall versions
Mitsubishi Electric CorporationData Transfer Classicall versions

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

09References

Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →
EPSS detail → Search KEV → Ask SARA →