CVE-2023-4088: Malicious Code Execution Vulnerability in FA Engineering Software Products
Incorrect Default Permissions vulnerability due to incomplete fix to address CVE-2020-14496 in Mitsubishi Electric Corporation FA engineering software products allows a malicious local attacker to execute a malicious code, which could result in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition. However, if the mitigated version described in the advisory for CVE-2020-14496 is used and installed in the default installation folder, this vulnerability does not affect the products.
Other sources
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation multiple FA engineering software products allows a malicious local attacker to execute a malicious code, resulting in information disclosure, tampering with and deletion, or a denial-of-service (DoS) condition, if the product is installed in a folder other than the default installation folder.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-4088.
What is the severity of CVE-2023-4088?
CVE-2023-4088 has a severity rating of critical (7.8).
Which software products are affected by CVE-2023-4088?
CVE-2023-4088 affects Mitsubishi Electric Corporation's FA engineering software product GX Works3.
What is the impact of CVE-2023-4088?
CVE-2023-4088 may allow a malicious local attacker to execute code, potentially resulting in information disclosure, tampering, or deletion.
Where can I find more information about CVE-2023-4088?
More information about CVE-2023-4088 can be found in the [official advisory by Mitsubishi Electric Corporation](https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-010_en.pdf).