CVE-2020-14496: Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-05-19 · updated 2026-06-17
Weakness: CWE-275

Description

Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information to be disclosed, tampered with, and/or destroyed.

Affected products

Mitsubishi Electric Corporation CPU Module Logging Configuration Tool: before 1.106k — fixed in 1.106k
Mitsubishi Electric CW Configurator: before 1.011m — fixed in 1.011m
Mitsubishi Electric Corporation Data Transfer: before 3.41t — fixed in 3.41t
Mitsubishielectric Em Configurator: before 1.015r — fixed in 1.015r
Mitsubishi Electric Corporation EZSocket: before 4.6 — fixed in 4.6
Mitsubishi Electric Corporation FR Configurator2: before 1.23z — fixed in 1.23z
Mitsubishielectric Gt Designer3: before 1.236w — fixed in 1.236w
Mitsubishielectric Gt Softgot1000: before 3.245f — fixed in 3.245f
Mitsubishi Electric Corporation GT SoftGOT2000: before 1.236w — fixed in 1.236w
Mitsubishi Electric Corporation GX LogViewer: before 1.106k — fixed in 1.106k
Mitsubishi Electric Corporation GX Works2: before 1.595v — fixed in 1.595v
Mitsubishi Electric Corporation GX Works3: before 1.065t — fixed in 1.065t
Mitsubishi Electric Corporation M_CommDTM-HART: before 1.01b — fixed in 1.01b
Mitsubishi Electric Corporation M_CommDTM-IO-Link: before 1.04e — fixed in 1.04e
Mitsubishi Electric Corporation MELFA-Works: before 4.4 — fixed in 4.4
Mitsubishi Electric Corporation MELSOFT FieldDeviceConfigurator: before 1.04e — fixed in 1.04e
Mitsubishi Electric Corporation MELSOFT Navigator: before 2.70y — fixed in 2.70y
Mitsubishi Electric Corporation MH11 SettingTool Version2: before 2.003d — fixed in 2.003d
Mitsubishi Electric Motorizer: before 1.010l — fixed in 1.010l
Mitsubishi Electric MR Configurator2: before 1.106l — fixed in 1.106l
Mitsubishi Electric Corporation MT Works2: before 1.160s — fixed in 1.160s
Mitsubishi Electric Corporation MX Component: before 4.20w — fixed in 4.20w
Mitsubishi Electric Corporation Network Interface Board CC-Link Ver.2 Utility: before 1.24a — fixed in 1.24a
Mitsubishi Electric Corporation Network Interface Board CC IE Control utility: before 1.30g — fixed in 1.30g
Mitsubishi Electric Corporation Network Interface Board CC IE Field Utility: before 1.17t — fixed in 1.17t
Mitsubishi Electric Corporation Network Interface Board MNETH utility: before 35m — fixed in 35m
Mitsubishi Electric Corporation PX Developer: before 1.53f — fixed in 1.53f
Mitsubishi Electric Corporation RT ToolBox2: before 3.73b — fixed in 3.73b
Mitsubishi Electric Corporation RT ToolBox3: before 1.80j — fixed in 1.80j

How to fix

Upgrade to a fixed version: Mitsubishi Electric Corporation CPU Module Logging Configuration Tool 1.106k; Mitsubishi Electric CW Configurator 1.011m; Mitsubishi Electric Corporation Data Transfer 3.41t; Mitsubishielectric Em Configurator 1.015r; Mitsubishi Electric Corporation EZSocket 4.6; Mitsubishi Electric Corporation FR Configurator2 1.23z; Mitsubishielectric Gt Designer3 1.236w; Mitsubishielectric Gt Softgot1000 3.245f; Mitsubishi Electric Corporation GT SoftGOT2000 1.236w; Mitsubishi Electric Corporation GX LogViewer 1.106k; Mitsubishi Electric Corporation GX Works2 1.595v; Mitsubishi Electric Corporation GX Works3 1.065t. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-14496 or the next vulnerability affects your stack