Description (CNA)
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Mitsubishi Electric Corporation / GX Works3 | affected all versions |
| Mitsubishi Electric Corporation / AL-PCS/WIN-E | affected all versions |
| Mitsubishi Electric Corporation / CPU Module Logging Configuration Tool | affected all versions |
| Mitsubishi Electric Corporation / EZSocket | affected all versions |
| Mitsubishi Electric Corporation / FR Configurator2 | affected all versions |
| Mitsubishi Electric Corporation / FX Configurator-EN | affected all versions |
| Mitsubishi Electric Corporation / FX Configurator-EN-L | affected all versions |
| Mitsubishi Electric Corporation / FX Configurator-FP | affected all versions |
| Mitsubishi Electric Corporation / GT Designer3 Version1(GOT1000) | affected all versions |
| Mitsubishi Electric Corporation / GT Designer3 Version1(GOT2000) | affected all versions |
| Mitsubishi Electric Corporation / GT SoftGOT1000 Version3 | affected all versions |
| Mitsubishi Electric Corporation / GT SoftGOT2000 Version1 | affected all versions |
| Mitsubishi Electric Corporation / GX LogViewer | affected all versions |
| Mitsubishi Electric Corporation / GX Works2 | affected all versions |
| Mitsubishi Electric Corporation / MELSOFT FieldDeviceConfigurator | affected all versions |
| Mitsubishi Electric Corporation / MELSOFT iQ AppPortal | affected all versions |
| Mitsubishi Electric Corporation / MELSOFT MaiLab | affected all versions |
| Mitsubishi Electric Corporation / MELSOFT Navigator | affected all versions |
| Mitsubishi Electric Corporation / MELSOFT Update Manager | affected all versions |
| Mitsubishi Electric Corporation / MX Component | affected all versions |
| Mitsubishi Electric Corporation / MX Sheet | affected all versions |
| Mitsubishi Electric Corporation / PX Developer | affected all versions |
| Mitsubishi Electric Corporation / RT ToolBox3 | affected all versions |
| Mitsubishi Electric Corporation / RT VisualBox | affected all versions |
| Mitsubishi Electric Corporation / Data Transfer | affected all versions |
| Mitsubishi Electric Corporation / Data Transfer Classic | affected all versions |
CWE
CWE-276
References
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
- https://jvn.jp/vu/JVNVU96447193/index.html
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.