CVE-2023-5247
External Control of File Name or Path (CWE-73)
Published: Nov 30, 2023 / Updated: 11mo ago
010
CVSS 7.8EPSS 0.04%High
CVE info copied to clipboard
Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service (DoS) condition.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
CVE Assignment
NVD published the first details for CVE-2023-5247
Nov 29, 2023 at 8:15 PM
First Article
Feedly found the first article mentioning CVE-2023-5247. See article
Nov 30, 2023 at 4:04 AM / CVE
CVSS Estimate
Feedly estimated the CVSS score as HIGH
Nov 30, 2023 at 4:04 AM
EPSS
EPSS Score was set to: 0.04% (Percentile: 5.7%)
Dec 1, 2023 at 3:33 PM
Affected Systems
Mitsubishielectric/gx_works3
+null more
Patches
www.mitsubishielectric.com
+null more
Links to Mitre Att&cks
T1562.003: Impair Command History Logging
+null more
Attack Patterns
CAPEC-13: Subverting Environment Variable Values
+null more
News
Bulletins Security Bulletin 6 Dec 2023 06 December 2023 SingCERT's Security Bulletin summarises the list of vulnerabilities collated from the National Institute of Standards and Technology (NIST)'s National Vulnerability Database (NVD) in the past week.
Rewterz Threat Advisory – ICS: Mitsubishi Electric FA Engineering Software Vulnerability
Mitsubishi Electric FA Engineering Software Products could allow a remote attacker to execute arbitrary code on the system, caused by external control of file names or paths. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system, obtain sensitive information, or cause a denial of service.
Remote code execution in Mitsubishi Electric FA Engineering Software Products
Vulnerable software versions The vulnerability allows a remote attacker to execute arbitrary code on the system.
Mitsubishi Electric FA Engineering Software Products
Successful exploitation of this vulnerability could allow a malicious attacker to execute malicious code by tricking legitimate users to open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service condition. This vulnerability could allow an attacker to execute a malicious code by having legitimate users open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service condition.
ICS hardware vulnerabilities disclosed in Delta Electronics, Yokogawa, PTC, Mitsubishi Electric equipment
The agency has found security loopholes in Delta Electronics DOPSoft, Yokogawa STARDOM, PTC KEPServerEx, and Mitsubishi Electric FA engineering software products deployed across the critical infrastructure sector. In its guidance, CISA announced the presence of a stack-based buffer overflow vulnerability across all versions of the Delta Electronics DOPSoft equipment, leading to an exploitable remotely/low attack complexity.
See 8 more articles and social media posts