CVE-2023-4088
Status: ModifiedHigh (7.8)—
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Base score: 7.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.18%
- Percentile among all scored CVEs: 7
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-276
- CWE-276
References
- https://jvn.jp/vu/JVNVU96447193/index.html
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
- https://jvn.jp/vu/JVNVU96447193/index.html
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf
Raw JSON (NVD)
Show
{
"id": "CVE-2023-4088",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-4088",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-24T18:27:00.307770Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 9.3,
"attackVector": "LOCAL",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 6,
"exploitabilityScore": 2.5
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"affectedData": [
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GX Works3",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "AL-PCS/WIN-E",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "CPU Module Logging Configuration Tool",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "EZSocket",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "FR Configurator2",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "FX Configurator-EN",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "FX Configurator-EN-L",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "FX Configurator-FP",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GT Designer3 Version1(GOT1000)",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GT Designer3 Version1(GOT2000)",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GT SoftGOT1000 Version3",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GT SoftGOT2000 Version1",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GX LogViewer",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "GX Works2",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT FieldDeviceConfigurator",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT iQ AppPortal",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT MaiLab",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT Navigator",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MELSOFT Update Manager",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MX Component",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "MX Sheet",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "PX Developer",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "RT ToolBox3",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "RT VisualBox",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "Data Transfer",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Mitsubishi Electric Corporation",
"product": "Data Transfer Classic",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2023-09-20T03:15:13.687",
"references": [
{
"url": "https://jvn.jp/vu/JVNVU96447193/index.html",
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03",
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
},
{
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf",
"tags": [
"Vendor Advisory"
],
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
},
{
"url": "https://jvn.jp/vu/JVNVU96447193/index.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-269-03",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-276"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder."
},
{
"lang": "es",
"value": "Vulnerabilidad de Permisos Predeterminados Incorrectos debido a una solución incompleta para abordar CVE-2020-14496 en los productos de software de ingeniería de Mitsubishi Electric Corporation FA permite que un atacante local malicioso ejecute un código malicioso, lo que podría resultar en la divulgación, manipulación y eliminación de información, o una condición de denegación fuera de servicio (DoS). Sin embargo, si la versión mitigada descrita en el aviso para CVE-2020-14496 se utiliza y se instala en la carpeta de instalación predeterminada, esta vulnerabilidad no afecta a los productos."
}
],
"lastModified": "2026-06-17T06:37:03.147",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4AEDEEE-5070-41E2-B4DC-6DE8456BC028"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp"
}