Description
Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service (DoS) condition.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mitsubishi Electric | GX Works3 | all versions | — |
| Mitsubishi Electric | MELSOFT iQ AppPortal | all versions | — |
| Mitsubishi Electric | MELSOFT Navigator | all versions | — |
| Mitsubishi Electric | Motion Control Setting | all versions | — |
Advisories 1
- ICSA-23-334-04 Mitsubishi Electric FA Engineering Software Products CISA ICS & IT advisories · Nov 30, 2023
References
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-016_en.pdf vendor-advisory
- https://jvn.jp/vu/JVNVU93383160/ government-resource