What’s Vulnerable › Vulnerabilities

CVE-2020-5602

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-30 · updated 2026-06-17
• Weakness: CWE-611

Description

Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit (EM Configurator) Ver. 1.010L and earlier, GT Designer3 (GOT2000) Ver. 1.221F and earlier, GX LogViewer Ver. 1.96A and earlier, GX Works2 Ver. 1.586L and earlier, GX Works3 Ver. 1.058L and earlier, M_CommDTM-HART Ver. 1.00A, M_CommDTM-IO-Link Ver. 1.02C and earlier, MELFA-Works Ver. 4.3 and earlier, MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool Ver.1.004E and earlier, MELSOFT FieldDeviceConfigurator Ver. 1.03D and earlier, MELSOFT iQ AppPortal Ver. 1.11M and earlier, MELSOFT Navigator Ver. 2.58L and earlier, MI Configurator Ver. 1.003D and earlier, Motion Control Setting Ver. 1.005F and earlier, MR Configurator2 Ver. 1.72A and earlier, MT Works2 Ver. 1.156N and earlier, RT ToolBox2 Ver. 3.72A and earlier, and RT ToolBox3 Ver. 1.50C and earlier) allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.

Affected products

• Mitsubishi Electric Corporation CPU Module Logging Configuration Tool: through 1.94y
• Mitsubishi Electric CW Configurator: through 1.010l
• Mitsubishielectric Em Configurator: through 1.010l
• Mitsubishielectric Gt Designer3: through 1.221f
• Mitsubishi Electric Corporation GX LogViewer: through 1.100e
• Mitsubishi Electric Corporation GX Works2: through 1.590q
• Mitsubishi Electric Corporation GX Works3: through 1.060n
• Mitsubishi Electric Corporation M_CommDTM-HART: through 1.01b
• Mitsubishi Electric Corporation M_CommDTM-IO-Link: through 1.03d
• Mitsubishi Electric Corporation MELFA-Works: through 4.4
• Mitsubishielectric Melsec-L Flexible High-Speed I/O Control Module Configuration Tool: through 1.005f
• Mitsubishi Electric Corporation MELSOFT FieldDeviceConfigurator: through 1.04e
• Mitsubishi Electric Corporation MELSOFT iQ AppPortal: through 1.14q
• Mitsubishi Electric Corporation MELSOFT Navigator: through 2.62q
• Mitsubishi Electric MI Configurator: through 1.004e
• Mitsubishi Electric Corporation Motion Control Setting: through 1.006g
• Mitsubishi Electric MR Configurator2: through 1.100e
• Mitsubishi Electric Corporation MT Works2: through 1.160s
• Mitsubishi Electric Corporation RT ToolBox2: through 3.73b
• Mitsubishi Electric Corporation RT ToolBox3: through 1.60n

References

• https://jvn.jp/en/vu/JVNVU90307594/index.html
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-004_en.pdf
• https://jvn.jp/en/vu/JVNVU90307594/index.html
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-004_en.pdf

Get alerted when CVE-2020-5602 or the next vulnerability affects your stack