Malicious Code Execution Vulnerability in FA Engineering Software Products

Vulnerability

Incorrect default permissions (CWE-276) exist in many Mitsubishi Electric FA engineering software products when installed in a folder other than the default installation folder [1][2]. Affected products include AL-PCS/WIN-E, CPU Module Logging Configuration Tool, EZSocket, FR Configurator2, FX Configurator-EN, FX Configurator-EN-L, FX Configurator-FP, GT Designer3 Version1 (GOT1000), GT Designer3 Version1 (GOT2000), GT SoftGOT1000 Version3, GT SoftGOT2000 Version1, GX LogViewer, GX Works2, GX Works3, MELSOFT FieldDeviceConfigurator, MELSOFT iQ AppPortal, MELSOFT MaiLab, MELSOFT Navigator, MELSOFT Update Manager, MX Component, MX Sheet, PX Developer, RT ToolBox3, RT VisualBox, Data Transfer, and Data Transfer Classic [2]. All versions of these products are impacted [2].

Exploitation

An attacker with local access to the system and no authentication can exploit this vulnerability when the software is installed in a non-default folder [1][2]. The incorrect permissions allow the attacker to place or modify executable files in the installation directory, leading to arbitrary code execution. The attack complexity is low, and no user interaction is required [2].

Impact

Successful exploitation can result in information disclosure, tampering with or deletion of information, or a denial-of-service (DoS) condition [1][2]. The CVSS v3 base score is 9.3 (Critical) with the vector string AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating a significant impact on confidentiality, integrity, and availability [2].

Mitigation

Mitsubishi Electric recommends the following workarounds: install the software in the default installation folder, or if a non-default folder is required, ensure it is only writable by administrators [1][2]. No patches have been released as of the advisory dates; affected users should implement the workarounds to mitigate the risk [1][2]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.