What’s Vulnerable › Vulnerabilities

CVE-2020-14521: Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-11 · updated 2026-06-17
• Weakness: CWE-428

Description

Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.

Affected products

• Mitsubishi Electric C Controller Interface Module Utility: all versions
• Mitsubishielectric C Controller Module Setting And Monitoring Tool: all versions
• Mitsubishi Electric CC-Link IE Control Network Data Collector: 1.00a
• Mitsubishi Electric CC-Link IE Field Network Data Collector: 1.00a
• Mitsubishi Electric CC-Link IE TSN Data Collector: 1.00a
• Mitsubishi Electric Corporation CPU Module Logging Configuration Tool: through 1.100e
• Mitsubishi Electric CW Configurator: through 1.010l
• Mitsubishi Electric Corporation Data Transfer: through 3.42u
• Mitsubishi Electric Corporation EZSocket: through 5.1
• Mitsubishi Electric Corporation FR Configurator2: all versions
• Mitsubishi Electric Corporation FR Configurator SW3: all versions
• Mitsubishi Electric GT Designer2 Classic: all versions
• Mitsubishielectric Gt Designer3: through 1.241b
• Mitsubishielectric Gt Softgot1000: from 3.0 through 3.200j
• Mitsubishi Electric Corporation GT SoftGOT2000: from 1.0 through 1.241b
• Mitsubishi Electric Corporation GX Developer: through 8.504a
• Mitsubishi Electric Corporation GX LogViewer: through 1.100e
• Mitsubishi Electric Corporation GX Works2: through 1.601b
• Mitsubishi Electric Corporation GX Works3: through 1.063r
• Mitsubishi Electric Corporation M_CommDTM-IO-Link: all versions
• Mitsubishi Electric Corporation MELFA-Works: through 4.4
• Mitsubishi Electric Corporation MELSEC WinCPU Setting Utility: all versions
• Mitsubishi Electric MELSOFT Complete Clean Up Tool: through 1.06g
• Mitsubishi Electric MELSOFT EM Software Development Kit: all versions
• Mitsubishi Electric Corporation MELSOFT iQ AppPortal: through 1.17t
• Mitsubishi Electric Corporation MELSOFT Navigator: through 2.74c
• Mitsubishi Electric MI Configurator: all versions
• Mitsubishi Electric Corporation Motion Control Setting: through 1.005f
• Mitsubishi Electric Motorizer: through 1.005f
• Mitsubishi Electric MR Configurator2: through 1.125f

References

• https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-04
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-04
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf

Get alerted when CVE-2020-14521 or the next vulnerability affects your stack