Skip to content
OpenAdvisories
High ICSA-20-212-04 1 CVE

Mitsubishi Electric Factory Automation Engineering Products (Update L)

Published Jul 30, 2020 · Updated May 28, 2026 · Revision 14

Vendor: Mitsubishi Electric Product: C Controller Interface Module Utility Product: CC-Link IE Control Network Data Collector Product: CC-Link IE Field Network Data Collector Product: CC-Link IE TSN Data Collector Product: CPU Module Logging Configuration Tool Product: CW Configurator Product: Data Transfer Product: EZSocket Product: FR Configurator SW3 Product: FR Configurator2 Product: GT Designer2 Classic Product: GT Designer3 Version1 (GOT1000) Product: GT Designer3 Version1 (GOT2000) Product: GT SoftGOT1000 Version3 Product: GT SoftGOT2000 Version1 Product: GX Developer Product: GX LogViewer Product: GX Works2 Product: GX Works3 Product: M_CommDTM-IO-Link Product: MELFA-Works Product: MELSEC WinCPU Setting Utility Product: MELSOFT Complete Clean Up Tool Product: MELSOFT EM Software Development Kit Product: MELSOFT iQ AppPortal Product: MELSOFT Navigator Product: MI Configurator Product: Motion Control Setting Product: Motorizer +25 more

Summary

Successful exploitation of this vulnerability could allow a remote attacker to disclose information, tamper with information, cause a denial-of-service (DoS) condition on the affected products, and so on by replacing certain files in the product which have improper permissions with crafted files.

Vulnerabilities 1

  • High 8.3
    CVE-2020-14521

    Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element

    Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.

    Mitsubishi Electric GX Works3 GX Works2 GT Designer3 Version1 (GOT2000) ICS / OT

Revision history

  1. #14

    CISA Republication update based on Mitsubishi Electric 2020-007 advisory

  2. #13

    Added FB libraries for Simple Motion Module (Positioning Control), Simple Motion Module (Synchronous Control), QD72P3C3, QD62 (E/D), LD62 (D), and QD64D2 to "Affected Products". Added FB libraries for Simple Motion Module (Positioning Control) and Simple Motion Module (Synchronous Control) that has been fixed to "Countermeasures".

  3. #12

    Added recommended actions for FR Configurator SW3, GT Designer2 Classic, and MELSEC WinCPU Setting Utility to "Countermeasures".

  4. #11

    Added Position Board utility 2 that has been fixed to "Countermeasures".

  5. #10

    Added C Controller Interface Module utility and MELSOFT EM Software Development Kit that have been fixed to "Countermeasures".

  6. #9

    Added MI Configurator, Setting/monitoring tools for the C Controller module (SW3PVC-CCPU), and Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) that have been fixed to "Countermeasures".

  7. #8

    Added FR Configurator2, M_CommDTM-IO-Link, Network Interface Board CC IE Control Utility, Network Interface Board CC IE Field Utility, Network Interface Board CC-Link Ver.2 Utility, and Network Interface Board MNETH Utility that have been fixed to "Countermeasures".

  8. #7

    Added CC-Link IE Control Network Data Collector, CC-Link IE Field Network Data Collector, CC-Link IE TSN Data Collector, MR Configurator2, MT Works2, MTConnect Data Collector, and SLMP Data Collector that have been fixed to "Countermeasures".

  9. #6

    Added MELFA-Works, RT ToolBox2, and RT ToolBox3 that have been fixed to "Countermeasures". Added CC-Link IE TSN Data Collector to "Affected Products".

  10. #5

    Added GX Works2, MELSOFT Complete Clean Up Tool, and MELSOFT Navigator that have been fixed to "Countermeasures".

  11. #4

    Added EZSocket and PX Developer that have been fixed to "Countermeasures".

  12. #3

    Added MELSOFT iQ AppPortal, MX Component, and MX Sheet that have been fixed to "Countermeasures".

  13. #2

    Added Data Transfer, GT Designer3 Version1 (GOT1000), GT Designer3 Version1 (GOT2000), GT SoftGOT1000 Version3, GT SoftGOT2000 Version1, MX MESInterface, and MX MESInterface-R that have been fixed to "Countermeasures".

  14. #1

    Initial Publication

References