Path traversal enables arbitrary code execution in Mitsubishi Electric Factory Automation products

Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.

The Mitsubishi Electric advisory and the updated JVN entry identify the following affected ranges and fixed versions:

• CW Configurator: version 1.010L and prior; fixed version 1.011M or later according to the advisory.
• FR Configurator2: version 1.22Y and prior; fixed version 1.23Z or later.
• GX Works2: version 1.595V and prior; fixed version 1.596W or later.
• GX Works3: version 1.063R and prior; fixed version 1.065T or later.
• MELSEC iQ-R Series Motion Module: version 10 and prior; fixed version 12 or later.
• MELSOFT iQ AppPortal: version 1.17T and prior; fixed version 1.20W or later.
• MELSOFT Navigator: version 2.70Y and prior; fixed version 2.74C or later.
• MI Configurator: the Mitsubishi Electric advisory and JVN list version 1.004E and prior as affected, with version 1.005F or later as fixed. The supplied normalized record says All Versions, so installations that do not match this boundary should be verified against local inventory and vendor guidance.
• MR Configurator2: version 1.110Q and prior; fixed version 1.115V or later.
• MT Works2: version 1.156N and prior; fixed version 1.160S or later.
• MX Component: version 4.20W and prior; fixed version 4.21X or later.
• RT ToolBox3: version 1.70Y and prior; fixed version 1.80J or later.
• IU Configuration Tool: version 1.04 and prior; JVN lists version 1.05 or later as fixed.
• IU Developer2: version 1.08 and prior; JVN lists version 1.09 or later as fixed.

The status of other versions or branches not covered by these sources remains unverified.

The weakness is CWE-22 Path Traversal in the handling of project files or configuration data files. An attacker can craft a malicious file that is later operated on by a user through an affected product. Mitsubishi Electric states that, when the customer has administrator privileges, processing the file can rewrite arbitrary executable files and library files, allowing attacker-controlled code to be written and executed.

The available sources do not identify the parsing routine, internal file format, specific path, or endpoint responsible for file processing. The exact delivery channel is also not documented. The sources identify crafted project files and configuration data files and mention ordinary file-transfer channels in mitigation guidance.

The sources describe a remote attacker crafting a malicious project file or configuration data file, but exploitation requires the file to be processed or operated on by an affected product. The supplied record contains conflicting assessments of the attack conditions: one assessment describes network access without authentication or user interaction, while the CNA assessment requires user interaction and higher complexity.

The vendor states that administrator privileges are required to rewrite arbitrary executable files and library files. Behavior under lower privileges is not established. The supplied record does not identify a public exploit and does not confirm a known-exploited status. That absence does not prove that exploitation has not occurred.

The flaw can lead to arbitrary code execution through the handling of a crafted project file or configuration data file. When the operating account has administrator privileges, the vendor confirms that arbitrary executable files and library files can be rewritten, after which attacker-controlled code may execute.

Realistic consequences include changes to engineering software, access to or modification of data available to the process, tool failure, and disruption of engineering operations. The available record does not establish that code runs with system-level privileges, does not prove a security-boundary crossing, and does not describe a specific affected control process.

• Integrity: A user with administrator privileges may be induced to rewrite executable files and library files, changing engineering software or components used by the affected product.
• Confidentiality: Arbitrary code running in the context of the application or user may access data available to that context.
• Availability: Altered executable files or libraries may prevent engineering tools from operating correctly, disrupt engineering workflows, or contribute to disruption in connected control environments.
• Actual consequences depend on the user privilege, the affected workstation or host, and whether that system is connected to a control environment. The record provides no evidence of a specific breach or incident.

1. Inventory all Mitsubishi Electric Factory Automation products, including products installed on engineering workstations, and update each product to its corresponding vendor-listed fixed version. Do not infer that a fix for one product also fixes another product or branch.
2. Obtain the fixed FR Configurator2 release through its product-specific download channel. For the other products, obtain updates through Mitsubishi Electric software channels and verify the installed version using each product's manual or help.
3. If an update cannot be applied, accept and operate only project files and configuration data files from verified sources. Reject or isolate files of unknown origin.
4. Operate the products with an account that does not have administrator privileges, except for MELSEC iQ-R Series Motion Module as noted by the vendor. Install antivirus software on computers using the products, also excepting that module under the vendor guidance.
5. Minimize network exposure for control-system devices and systems, block access from untrusted networks or hosts, place control-system networks and remote devices behind firewalls, isolate them from the business network, and use a VPN when remote access is required.
6. After updating, recheck inventory and review executable-file and library-file changes on systems that processed untrusted project or configuration files.

• Inventory engineering workstations and control-system environments that run the affected products, then compare product names and versions with the affected branches.
• Identify project files and configuration data files entering operational workflows, especially files received through email, USB media, file servers, or unverified sources.
• Review changes to executable files and library files on systems running the products, with attention to changes occurring after a project or configuration file was opened or operated on.
• Review endpoint protection or antivirus telemetry around product use. This is precautionary monitoring, not a vendor-confirmed indicator of compromise.
• Do not treat the absence of matching log events as proof of safety. The advisory does not provide a product-specific log signature or IOC.