CVE-2023-4088
Estado: ModificadaAlta (7.8)—
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.18%
- Percentil entre todas las CVEs puntuadas: 7
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-276
- CWE-276
Referencias
- https://jvn.jp/vu/JVNVU96447193/index.html
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
- https://jvn.jp/vu/JVNVU96447193/index.html
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
JSON original (NVD)
Mostrar
{
"id": "CVE-2023-4088",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-4088",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-24T18:27:00.307770Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 9.3,
"attackVector": "LOCAL",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2.5
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"affectedData": [
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GX Works3",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "AL-PCS/WIN-E",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "CPU Module Logging Configuration Tool",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "EZSocket",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "FR Configurator2",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "FX Configurator-EN",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "FX Configurator-EN-L",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "FX Configurator-FP",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GT Designer3 Version1(GOT1000)",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GT Designer3 Version1(GOT2000)",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GT SoftGOT1000 Version3",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GT SoftGOT2000 Version1",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GX LogViewer",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GX Works2",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT FieldDeviceConfigurator",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT iQ AppPortal",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT MaiLab",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT Navigator",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT Update Manager",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MX Component",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MX Sheet",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "PX Developer",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "RT ToolBox3",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "RT VisualBox",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "Data Transfer",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "Data Transfer Classic",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2023-09-20T03:15:13.687",
"references": [
{
"url": "https://jvn.jp/vu/JVNVU96447193/index.html",
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03",
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
},
{
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf",
"tags": [
"Vendor Advisory"
],
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
},
{
"url": "https://jvn.jp/vu/JVNVU96447193/index.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder."
},
{
"lang": "es",
"value": "Vulnerabilidad de Permisos Predeterminados Incorrectos debido a una solución incompleta para abordar CVE-2020-14496 en los productos de software de ingeniería de Mitsubishi Electric Corporation FA permite que un atacante local malicioso ejecute un código malicioso, lo que podría resultar en la divulgación, manipulación y eliminación de información, o una condición de denegación fuera de servicio (DoS). Sin embargo, si la versión mitigada descrita en el aviso para CVE-2020-14496 se utiliza y se instala en la carpeta de instalación predeterminada, esta vulnerabilidad no afecta a los productos."
}
],
"lastModified": "2026-06-17T06:37:03.147",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4AEDEEE-5070-41E2-B4DC-6DE8456BC028"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
}