CVE-2019-10976

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-26 · updated 2026-06-17
Weakness: CWE-611

Description

Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.

Affected products

Mitsubishielectric Electric Fr Configurator2 Firmware: before 1.16s — fixed in 1.16s

How to fix

Upgrade to a fixed version: Mitsubishielectric Electric Fr Configurator2 Firmware 1.16s. Check the vendor advisory for mitigations.

References

https://www.us-cert.gov/ics/advisories/icsa-19-204-01
https://www.us-cert.gov/ics/advisories/icsa-19-204-01

Get alerted when CVE-2019-10976 or the next vulnerability affects your stack