The vulnerability arises from an incorrect implementation of the authentication algorithm in Mitsubishi Electric GX Works3 and Motion Control Setting, allowing a local attacker who has physical or local access to a device to bypass the block password check. By executing the affected application and modifying part of its executable module in memory, the attacker can authenticate without a valid password. Once authenticated, the attacker may view, tamper with, destroy, or delete control programs, potentially compromising the safety and operation of the controlled machinery.

Affected vendors are Mitsubishi Electric Corporation with products GX Works3 and Motion Control Setting. Specific affected versions are not listed in the available data, so all released releases of these products should be considered potentially vulnerable until a vendor patch is applied.

The CVSS score of 9.2 classifies the flaw as Critical, indicating a high impact on confidentiality, integrity, and availability. The EPSS score of less than 1% shows that, although the probability of exploitation is currently low, the flaw remains significant due to the local nature of the attack. Because the vulnerability is not listed in the CISA KEV catalog, it has not been widely reported as exploited yet. Nonetheless, a local attacker can exploit the flaw by physically accessing the device or through a local network path, executing the program, and modifying memory to bypass authentication. The potential to tamper with control programs makes this a severe security risk for industrial control environments.