Motion Control Setting
Monthly
Local block-password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting lets an attacker who can run the engineering software and modify part of its executable module in memory authenticate with an invalid block password, defeating the protection on control-program blocks and potentially exposing, altering, corrupting, or deleting PLC logic. The root cause is an incorrect implementation of the authentication algorithm (CWE-303), which means the password check can be subverted rather than being cryptographically sound. Exploitation is access-gated: it requires local access to an engineering workstation and the ability to manipulate the running process, with no remote or unauthenticated path, and no public exploit identified at time of analysis.
Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local block-password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting lets an attacker who can run the engineering software and modify part of its executable module in memory authenticate with an invalid block password, defeating the protection on control-program blocks and potentially exposing, altering, corrupting, or deleting PLC logic. The root cause is an incorrect implementation of the authentication algorithm (CWE-303), which means the password check can be subverted rather than being cryptographically sound. Exploitation is access-gated: it requires local access to an engineering workstation and the ability to manipulate the running process, with no remote or unauthenticated path, and no public exploit identified at time of analysis.
Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.