Log in Start free

Vulnerability · Published Feb 11, 2022 · Assigned by icscert

CVE-2020-14523Mitsubishi Electric Factory Automation Products Path Traversal

High 8.3

In plain English

A high-severity path traversal in CW Configurator from Mitsubishi Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)2.3%top 17.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric CW Configurator unspecified – through Version 1.010L
Mitsubishi Electric FR Configurator2 unspecified – through Version 1.22Y
Mitsubishi Electric GX Works2 unspecified – through Version 1.595V
Mitsubishi Electric GX Works3 unspecified – through Version 1.063R
Mitsubishi Electric MELSOFT iQ AppPortal unspecified – through Version 1.17T
Mitsubishi Electric MELSOFT Navigator unspecified – through Version2.70Y
Mitsubishi Electric MI Configurator All Versions
Mitsubishi Electric MR Configurator2 unspecified – through Version 1.110Q
Mitsubishi Electric MT Works2 unspecified – through Versions 1.156N
Mitsubishi Electric MX Component unspecified – through Version 4.20W
Mitsubishi Electric RT ToolBox3 unspecified – through Versions 1.70Y
Mitsubishi Electric MELSEC iQ-R Series Motion Module unspecified – through Versions 10

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References