CVE-2023-4088 Malicious Code Execution Vulnerability in FA Engineering Software Products

What is CVE-2023-4088?

CVE-2023-4088 is a critical vulnerability in Mitsubishi Electric Corporation AL-PCS/WIN-E, published on 20 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.

Weakness: CWE-276

Which versions are affected by CVE-2023-4088?

It affects 1 product.

Products include Mitsubishielectric Gx Works3.

How do I fix CVE-2023-4088?

No fix has been published for CVE-2023-4088 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-4088 being exploited?

There is no known exploitation of CVE-2023-4088 in the wild and no public exploit code.

Other vulnerabilities in Mitsubishi Electric Corporation AL-PCS/WIN-E

• CVE-2022-29830 Hardcoded credentials in GX Works3 Critical 9.1
• CVE-2022-25164 Information disclosure in GX Works3 High 8.6
• CVE-2023-5247 Path traversal in GX Works3 High 7.8
• CVE-2022-29831 Hardcoded credentials in GX Works3 High 7.5
• CVE-2022-29826 Information disclosure in GX Works3 Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2325-58pf-r6qj.