Mitsubishi Electric
Monthly
Local block-password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting lets an attacker who can run the engineering software and modify part of its executable module in memory authenticate with an invalid block password, defeating the protection on control-program blocks and potentially exposing, altering, corrupting, or deleting PLC logic. The root cause is an incorrect implementation of the authentication algorithm (CWE-303), which means the password check can be subverted rather than being cryptographically sound. Exploitation is access-gated: it requires local access to an engineering workstation and the ability to manipulate the running process, with no remote or unauthenticated path, and no public exploit identified at time of analysis.
Remote unauthenticated attackers can bypass authentication on Mitsubishi Electric FA products through a specific API route to execute arbitrary OS commands, as reflected by CWE-306 (Missing Authentication for Critical Function). The independent CVSS 3.1 assessment rates this 8.7 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impact, though exploitation requires network reachability to the management/API interface. No public exploit code or confirmed active exploitation is identified in the available intelligence; the primary risk is unsegmented exposure of the device's API.
Local attackers with existing low-privileged access to a Windows host running Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI (10.97.2 CFR3 and prior), or MC Works64 (all versions) can tamper with the software keyboard ('keypad') function's configuration file so that it points to an attacker-supplied executable; when a legitimate user next invokes the keypad, that EXE executes in the user's context. The result is arbitrary code execution leading to disclosure, tampering, deletion or destruction of data on the affected PC, or a denial-of-service condition, and the scope change (S:C) reflects that the spawned process is not constrained to the vulnerable component. Exploitation is heavily gated - it requires a pre-existing local foothold, write permission on the keypad configuration file, and a victim actually using the keypad - and there is no public exploit identified at time of analysis, with EPSS at just 0.57% (45th percentile), so this is an access-gated insider/local risk rather than an internet-facing crisis.
Local block-password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting lets an attacker who can run the engineering software and modify part of its executable module in memory authenticate with an invalid block password, defeating the protection on control-program blocks and potentially exposing, altering, corrupting, or deleting PLC logic. The root cause is an incorrect implementation of the authentication algorithm (CWE-303), which means the password check can be subverted rather than being cryptographically sound. Exploitation is access-gated: it requires local access to an engineering workstation and the ability to manipulate the running process, with no remote or unauthenticated path, and no public exploit identified at time of analysis.
Remote unauthenticated attackers can bypass authentication on Mitsubishi Electric FA products through a specific API route to execute arbitrary OS commands, as reflected by CWE-306 (Missing Authentication for Critical Function). The independent CVSS 3.1 assessment rates this 8.7 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impact, though exploitation requires network reachability to the management/API interface. No public exploit code or confirmed active exploitation is identified in the available intelligence; the primary risk is unsegmented exposure of the device's API.
Local attackers with existing low-privileged access to a Windows host running Mitsubishi Electric GENESIS64, ICONICS Suite, MobileHMI (10.97.2 CFR3 and prior), or MC Works64 (all versions) can tamper with the software keyboard ('keypad') function's configuration file so that it points to an attacker-supplied executable; when a legitimate user next invokes the keypad, that EXE executes in the user's context. The result is arbitrary code execution leading to disclosure, tampering, deletion or destruction of data on the affected PC, or a denial-of-service condition, and the scope change (S:C) reflects that the spawned process is not constrained to the vulnerable component. Exploitation is heavily gated - it requires a pre-existing local foothold, write permission on the keypad configuration file, and a victim actually using the keypad - and there is no public exploit identified at time of analysis, with EPSS at just 0.57% (45th percentile), so this is an access-gated insider/local risk rather than an internet-facing crisis.