Description
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mitsubishi Electric | GX Works3 | all versions | — |
| Mitsubishi Electric | AL-PCS/WIN-E | all versions | — |
| Mitsubishi Electric | CPU Module Logging Configuration Tool | all versions | — |
| Mitsubishi Electric | EZSocket | all versions | — |
| Mitsubishi Electric | FR Configurator2 | all versions | — |
| Mitsubishi Electric | FX Configurator-EN | all versions | — |
| Mitsubishi Electric | FX Configurator-EN-L | all versions | — |
| Mitsubishi Electric | FX Configurator-FP | all versions | — |
| Mitsubishi Electric | GT Designer3 Version1(GOT1000) | all versions | — |
| Mitsubishi Electric | GT Designer3 Version1(GOT2000) | all versions | — |
| Mitsubishi Electric | GT SoftGOT1000 Version3 | all versions | — |
| Mitsubishi Electric | GT SoftGOT2000 Version1 | all versions | — |
| Mitsubishi Electric | GX LogViewer | all versions | — |
| Mitsubishi Electric | GX Works2 | all versions | — |
| Mitsubishi Electric | MELSOFT FieldDeviceConfigurator | all versions | — |
| Mitsubishi Electric | MELSOFT iQ AppPortal | all versions | — |
| Mitsubishi Electric | MELSOFT MaiLab | all versions | — |
| Mitsubishi Electric | MELSOFT Navigator | all versions | — |
| Mitsubishi Electric | MELSOFT Update Manager | all versions | — |
| Mitsubishi Electric | MX Component | all versions | — |
| Mitsubishi Electric | MX Sheet | all versions | — |
| Mitsubishi Electric | PX Developer | all versions | — |
| Mitsubishi Electric | RT ToolBox3 | all versions | — |
| Mitsubishi Electric | RT VisualBox | all versions | — |
| Mitsubishi Electric | Data Transfer | all versions | — |
| Mitsubishi Electric | Data Transfer Classic | all versions | — |
Advisories 1
- ICSA-23-269-03 Mitsubishi Electric FA Engineering Software (Update A) CISA ICS & IT advisories · Jul 9, 2024
References
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf vendor-advisory
- https://jvn.jp/vu/JVNVU96447193/index.html government-resource
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03 government-resource