CVE record · CVE-2023-4088

Malicious Code Execution Vulnerability in FA Engineering Software Products

CVSS 9.3 CriticalCriticalEPSS 0.0019 · 8th percentile

Critical, because:

CVSS score 9.3: 9.0 or more.

Published by the CVE Program (CNA: Mitsubishi) at 20 Sept 2023, 02:26 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Mitsubishi Electric Corporation	GX Works3	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	AL-PCS/WIN-E	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	CPU Module Logging Configuration Tool	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	EZSocket	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	FR Configurator2	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	FX Configurator-EN	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	FX Configurator-EN-L	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	FX Configurator-FP	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GT Designer3 Version1(GOT1000)	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GT Designer3 Version1(GOT2000)	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GT SoftGOT1000 Version3	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GT SoftGOT2000 Version1	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GX LogViewer	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GX Works2	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSOFT FieldDeviceConfigurator	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSOFT iQ AppPortal	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSOFT MaiLab	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSOFT Navigator	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSOFT Update Manager	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MX Component	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MX Sheet	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	PX Developer	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	RT ToolBox3	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	RT VisualBox	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Data Transfer	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	Data Transfer Classic	affected all versions Other versions: unaffected

Identifiers: CVE-2023-4088
CNA: Mitsubishi
Weakness (CWE): CWE-276
Tags: Mitsubishi Electric Corporation GX Works3
Mitsubishi Electric Corporation AL-PCS/WIN-E
Mitsubishi Electric Corporation CPU Module Logging Configuration Tool
Mitsubishi Electric Corporation EZSocket
Mitsubishi Electric Corporation FR Configurator2
Mitsubishi Electric Corporation FX Configurator-EN
Mitsubishi Electric Corporation FX Configurator-EN-L
Mitsubishi Electric Corporation FX Configurator-FP
Broken access control
Published: 20 Sept 2023
Updated: 24 Sept 2024

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
9.3	Critical	3.1	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	CNA (Mitsubishi)

CISA KEV Not listed.
EPSS 0.0019, the 8th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 20 Sept 2023. New records show when each source confirmed them.

Sources

References from the CNA

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf vendor-advisory
jvn.jp/vu/JVNVU96447193/index.html government-resource
www.cisa.gov/news-events/ics-advisories/icsa-23-269-03 government-resource

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.