CVE-2023-5247

Summary

Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service (DoS) condition.

Affected Software

VendorProductVersion RangeStatus
Mitsubishi Electric CorporationGX Works3all versionsaffected
Mitsubishi Electric CorporationMELSOFT iQ AppPortalall versionsaffected
Mitsubishi Electric CorporationMELSOFT Navigatorall versionsaffected
Mitsubishi Electric CorporationMotion Control Settingall versionsaffected

Weaknesses

  • CWE-73: CWE-73 External Control of File Name or Path

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References