Skip to content
NewA calmer, faster ZeroHour
Advisorymedium

Mitsubishi Electric GX Works3 and Motion Control Settings

CISA Advisoriesby CISA ()3 min read2 · 1 read
Read at cisa.gov
Part of a story covered by 2 sourcesCISA Issues Two Mitsubishi Electric Advisories: CC-Link IE TSN Packet Tampering and GX Works3 Block Password Bypass (CVE-2026-15688)Merged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

CISA warns CVE-2026-15688 lets a local attacker bypass block password authentication in Mitsubishi Electric GX Works3 and tamper with control programs.

CISA republished Mitsubishi Electric advisory 2026-007 describing CVE-2026-15688, an incorrect implementation of the authentication algorithm (CWE-303) in GX Works3 and the bundled Motion Control Settings, affecting all versions. A local attacker can authenticate with an invalid block password, modify an executable module in memory, and view, tamper with, destroy, or delete control programs. CVSS v3.1 base score is 8.8 (v4.0: 9.2), and CISA recommends isolating control system networks and minimizing internet exposure.

Key facts
  • CVE-2026-15688 is a CWE-303 authentication algorithm flaw rated 8.8 (CVSS v3.1) and 9.2 (v4.0)
  • Local attacker can bypass invalid block password checks and modify executable modules in memory
  • All GX Works3 versions and packaged Motion Control Settings are affected
  • Attackers can view, tamper with, destroy, or delete PLC control programs
  • CISA urges isolating control networks and restricting internet exposure
Analyze CVE-2026-15688 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-15688
Tags
authentication-bypasscisacwe-303gx-works3icsindustrial-control-systemsmitsubishi-electric
Vendors
Mitsubishi ElectricCISA
Products
GX Works3Motion Control Settings
Organizations
Mitsubishi ElectricCISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-15688
Block password bypass in Mitsubishi Electric GX Works3 and Motion Control Setting
9.2—

From the original article

3 min read at cisa.gov

View CSAF Summary Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, destroy, or delete control programs.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.