CVE-2023-4088

Malicious Code Execution Vulnerability in FA Engineering Software Products

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

Vulnerabilidad de Permisos Predeterminados Incorrectos debido a una solución incompleta para abordar CVE-2020-14496 en los productos de software de ingeniería de Mitsubishi Electric Corporation FA permite que un atacante local malicioso ejecute un código malicioso, lo que podría resultar en la divulgación, manipulación y eliminación de información, o una condición de denegación fuera de servicio (DoS). Sin embargo, si la versión mitigada descrita en el aviso para CVE-2020-14496 se utiliza y se instala en la carpeta de instalación predeterminada, esta vulnerabilidad no afecta a los productos.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2023-08-02 CVE Reserved
2023-09-20 CVE Published
2023-09-22 EPSS Updated
2024-09-24 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-276: Incorrect Default Permissions

CAPEC

References (3)

URL	Tag	Source
https://jvn.jp/vu/JVNVU96447193/index.html	Government Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03	Government Resource

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf	2024-07-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mitsubishielectric Search vendor "Mitsubishielectric"		Gx Works3 Search vendor "Mitsubishielectric" for product "Gx Works3"				*		-		Affected