CVE-2023-4088
Malicious Code Execution Vulnerability in FA Engineering Software Products
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Malicious Code Execution Vulnerability in FA Engineering Software Products
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
- Record
CVE-2023-4088- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
EUVDEUVD-2023-53978
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
- Record
EUVD-2023-53978- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2325-58pf-r6qj
Incorrect Default Permissions vulnerability due to incomplete fix to address CVE-2020-14496 in...
Incorrect Default Permissions vulnerability due to incomplete fix to address CVE-2020-14496 in Mitsubishi Electric Corporation FA engineering software products allows a malicious local attacker to execute a malicious code, which could result in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition. However, if the mitigated version described in the advisory for CVE-2020-14496 is used and installed in the default installation folder, this vulnerability does not affect the products.
- Record
GHSA-2325-58pf-r6qj- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
NVD
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
- Record
CVE-2023-4088- CVSS 3.1
- 9.3 Critical
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
Affected products
- mitsubishi electric melsoft fielddeviceconfigurator
- mitsubishi electric melsoft iq appportal
- mitsubishi electric mx sheet
- mitsubishi electric corporation al-pcs/win-e
- mitsubishi electric corporation cpu module logging configuration tool
- mitsubishi electric corporation data transfer
- mitsubishi electric corporation data transfer classic
- mitsubishi electric corporation ezsocket
- mitsubishi electric corporation fr configurator2
- mitsubishi electric corporation fx configurator-en
- mitsubishi electric corporation fx configurator-en-l
- mitsubishi electric corporation fx configurator-fp
Show 18 moreShow less
- mitsubishi electric corporation gt designer3 version1(got1000)
- mitsubishi electric corporation gt designer3 version1(got2000)
- mitsubishi electric corporation gt softgot1000 version3
- mitsubishi electric corporation gt softgot2000 version1
- mitsubishi electric corporation gx logviewer
- mitsubishi electric corporation gx works2
- mitsubishi electric corporation gx works3
- mitsubishi electric corporation melsoft fielddeviceconfigurator
- mitsubishi electric corporation melsoft iq appportal
- mitsubishi electric corporation melsoft mailab
- mitsubishi electric corporation melsoft navigator
- mitsubishi electric corporation melsoft update manager
- mitsubishi electric corporation mx component
- mitsubishi electric corporation mx sheet
- mitsubishi electric corporation px developer
- mitsubishi electric corporation rt toolbox3
- mitsubishi electric corporation rt visualbox
- mitsubishielectric gx works3
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4088 is a critical vulnerability (CVSS 9.3) in Mitsubishi Electric Melsoft Fielddeviceconfigurator, published September 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. No source names a fixed version.