Critical Authentication Bypass Found in Mitsubishi Electric GX Works3 and Motion Control Settings
CVE-2026-15688 bypasses block passwords in GX Works3 and Motion Control Settings.
On September 17, 2026 the Cybersecurity and Infrastructure Security Agency (CISA) republished Mitsubishi Electric’s security advisory 2026‑007 as ICSA‑26‑260‑02, flagging a critical authentication bypass in the company’s GX Works3 engineering suite and the bundled Motion Control Settings tool. The flaw, cataloged as CVE-2026-15688, affects all released versions of both products and scores 8.8 on the CVSS v3.1 scale (High) and 9.2 on CVSS v4.0 (Critical).
#What Happened
The vulnerability stems from an "Incorrect Implementation of Authentication Algorithm" – technically classified as CWE-303. In the block‑password routine, the software fails to correctly validate the password hash when the executable module is altered in memory. A local attacker who can launch the program and tamper with its in‑memory image can convince the application that any password, even an empty or wrong one, is valid.
This is a local privilege‑escalation issue. Exploitation requires the attacker to have execution rights on the workstation running GX Works3 or Motion Control Settings, but once achieved, the attacker can bypass the block password and gain unrestricted access to industrial control programs.
#How the Bypass Works
- Launch the target binary – The attacker starts GX Works3 or Motion Control Settings on a Windows workstation.
- Inject a memory‑modifying payload – Using a debugger, a custom script, or a generic memory‑editing tool, the attacker overwrites the portion of the executable that performs the password check.
- Force a successful authentication – The patched code returns a success flag regardless of the password supplied.
- Access the project – With the block password effectively disabled, the attacker can open, edit, delete, or export any control program stored in the project file.
