CVE-2023-51776 is an improper privilege management flaw in Jungo WinDriver before version 12.1.0. A local attacker can escalate privileges and run arbitrary code. The record rates it High at 7.8. Mitsubishi Electric software that bundles WinDriver is also affected, so check those products as well.
What's affected
The record names Jungo WinDriver before 12.1.0, and lists several Mitsubishi Electric engineering tools that use it, including the CPU Module Logging Configuration Tool, CW Configurator and Data Transfer.
The CISA advisory ICSA-24-135-04 (Update G) names affected versions for each Mitsubishi product. Examples from that advisory are CPU Module Logging Configuration Tool 1.154L and earlier, CW Configurator 1.019V and earlier, Data Transfer 3.58L and earlier, and EZSocket 5.92 and earlier. Fixed versions differ by product and the advisory should be checked for each. The list was long, so read the full document for your tools.
The record gives a CVSS score of 7.8 (High). The CVSS vector reads as follows. The attack needs local access to the system, and the complexity is low. A low-privilege account is needed. No user interaction is required. Impact on confidentiality is high, on integrity high, and on availability high. The weakness class is CWE-269.
How to check if you're exposed
Check two things. First, is WinDriver installed on its own, for example by a hardware vendor's driver package? Look at installed programs and drivers on Windows for Jungo or WinDriver entries, and compare the version with 12.1.0.
Second, check for the Mitsubishi Electric FA engineering tools named in the advisory. Engineering workstations often have several of them. Compare each installed version with the advisory's table.
What to do now
- Inventory engineering workstations that run Mitsubishi Electric FA tools, and any systems with WinDriver based drivers.
- Update WinDriver to 12.1.0 or later where you control it.
- For Mitsubishi products, follow the product specific fixed versions and mitigations in the Mitsubishi and CISA advisories.
- Limit local accounts on engineering workstations to those who need them.
- Treat these machines as high value, since they can change controller programs.
Why it matters
The weakness is improper privilege management. WinDriver is a toolkit that helps developers write drivers, and drivers run with high privilege. When the access rules are weak, a low privilege local user can use the driver to do things only the system should do, which can end in code running with elevated rights.
The CISA advisory mentions that related vulnerabilities in the same library can cause a Windows blue screen, which is a denial of service, as well as privilege escalation. This CVE is the privilege management one. Many other CVEs share the advisory.
This is a supply chain story. A flaw in one third party driver library appears in many products from many vendors, and the downstream vendors each ship their own fixes. Tracking which of your tools embed the library is half the work.
Quick check
Who is affected, WinDriver users only?
No. Mitsubishi Electric lists several of its engineering tools that embed WinDriver as well.
Does an attacker need a local account?
Yes. The record shows local access and low privileges are required.
Sources
Last reviewed: 19 October 2026.
