Mitsubishi Electric GX Works3 and Motion Control Settings
Plan PatchCVSS 8.8ICS-CERT ICSA-26-260-02Sep 17, 2026
Mitsubishi ElectricEnergy
Attack path
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
A local attacker with standard user privileges can bypass the block password protection in GX Works3 (all versions) and Motion Control Settings (all versions) by modifying the executable module in memory during runtime. Once the password is bypassed, the attacker can view, modify, or delete PLC control programs without authorization. The vulnerability is triggered when a local user runs the affected software and executes code that circumvents the password check.
What this means
What could happen
A local attacker with low privileges can bypass the block password protection on GX Works3 or Motion Control Settings, then modify executable modules in memory to view, alter, or delete PLC control programs. This could allow unauthorized changes to industrial process logic or complete loss of control program integrity.
Who's at risk
Energy sector organizations using Mitsubishi Electric GX Works3 or Motion Control Settings on engineering workstations should be concerned. This affects anyone responsible for PLC programming and commissioning, including engineers and technicians with local access to these tools used to develop and modify industrial control logic.
How it could be exploited
An attacker with a local user account on the engineering workstation logs in and runs GX Works3 or Motion Control Settings. They execute the affected product and modify the executable module in memory to bypass the block password authentication mechanism. Once bypassed, they can access and modify control programs without knowing the correct password.
Prerequisites
Local user account on the workstation running GX Works3 or Motion Control Settings
Access to the engineering workstation where the software is installed
All versions of GX Works3 or Motion Control Settings affected
low complexity exploitlow privileges required (standard user account)affects control program integrityno authentication required after bypass
Exploitability
Unlikely to be exploited — EPSS score 0.1%
Affected products (2)
2 pending
ProductAffected VersionsFix Status
GX Works3All versionsNo fix yet
Motion Control Settings (Software packaged with GX Works3)All versionsNo fix yet
Remediation & Mitigation
0/6
Do now
0/2
GX Works3
HARDENINGDeploy a firewall or VPN to prevent unauthorized network access to computers running GX Works3 or Motion Control Settings
All products
WORKAROUNDRestrict remote login access to engineering workstations—allow only trusted users and block all remote logins from untrusted networks and hosts
Schedule — requires maintenance window
0/3
Patching may require device reboot — plan for process interruption
GX Works3
HOTFIXUpdate GX Works3 to version 1.096A or later from the Mitsubishi Electric download portal
HOTFIXAfter updating, set the security version for all projects to '2' in GX Works3 and Motion Control Settings (refer to section 15.9 in GX Works3 Operating Manual or section 12.5 in Motion Control Setting Function Help)
All products
HOTFIXUpdate Motion Control Settings to version 1.070Y or later from the Mitsubishi Electric download portal
Long-term hardening
0/1
HARDENINGIsolate engineering workstations on a dedicated LAN segment to limit local user access to authorized personnel only
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.