What’s Vulnerable › Vulnerabilities

CVE-2020-14523: Mitsubishi Electric Factory Automation Products Path Traversal

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-11 · updated 2026-06-17
• Weakness: CWE-22

Description

Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.

Affected products

• Mitsubishi Electric CW Configurator: through 1.010l
• Mitsubishi Electric Corporation FR Configurator2: through 1.22y
• Mitsubishi Electric Corporation GX Works2: through 1.595v
• Mitsubishi Electric Corporation GX Works3: through 1.063r
• Mitsubishielectric Iu Configuration Tool: through 1.04
• Mitsubishielectric Iu Developer2: through 1.08
• Mitsubishi Electric Corporation MELSOFT iQ AppPortal: through 1.17t
• Mitsubishi Electric Corporation MELSOFT Navigator: through 2.70y
• Mitsubishi Electric MI Configurator: all versions
• Mitsubishi Electric MR Configurator2: through 1.110q
• Mitsubishi Electric Corporation MT Works2: through 1.156n
• Mitsubishi Electric Corporation MX Component: through 4.20w
• Mitsubishielectric Rd78G16 Firmware: through 10
• Mitsubishielectric Rd78G32 Firmware: through 10
• Mitsubishielectric Rd78G4 Firmware: through 10
• Mitsubishielectric Rd78G64 Firmware: through 10
• Mitsubishielectric Rd78G8 Firmware: through 10
• Mitsubishielectric Rd78Ghv Firmware: through 10
• Mitsubishielectric Rd78Ghw Firmware: through 10
• Mitsubishi Electric Corporation RT ToolBox3: through 1.70y

References

• https://jvn.jp/vu/JVNVU90224831/
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-03
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdf
• https://jvn.jp/vu/JVNVU90224831/
• https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-03
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdf

Get alerted when CVE-2020-14523 or the next vulnerability affects your stack