CVE-2020-14521 Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element
Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: Mitsubishi Electric
product: C Controller Interface Module Utility
default_status: unaffected
vendor: Mitsubishi Electric
product: CC-Link IE Control Network Data Collector
default_status: unaffected
vendor: Mitsubishi Electric
product: CC-Link IE Field Network Data Collector
default_status: unaffected
vendor: Mitsubishi Electric
product: CC-Link IE TSN Data Collector
default_status: unaffected
vendor: Mitsubishi Electric
product: CPU Module Logging Configuration Tool
default_status: unaffected
vendor: Mitsubishi Electric
product: CW Configurator
default_status: unaffected
vendor: Mitsubishi Electric
product: Data Transfer
default_status: unaffected
vendor: Mitsubishi Electric
product: EZSocket
default_status: unaffected
vendor: Mitsubishi Electric
product: FR Configurator SW3
default_status: unaffected
vendor: Mitsubishi Electric
product: FR Configurator2
default_status: unaffected
vendor: Mitsubishi Electric
product: GT Designer2 Classic
default_status: unaffected
vendor: Mitsubishi Electric
product: GT Designer3 Version1 (GOT1000)
default_status: unaffected
vendor: Mitsubishi Electric
product: GT Designer3 Version1 (GOT2000)
default_status: unaffected
vendor: Mitsubishi Electric
product: GT SoftGOT1000 Version3
default_status: unaffected
vendor: Mitsubishi Electric
product: GT SoftGOT2000 Version1
default_status: unaffected
vendor: Mitsubishi Electric
product: GX Developer
default_status: unaffected
vendor: Mitsubishi Electric
product: GX LogViewer
default_status: unaffected
vendor: Mitsubishi Electric
product: GX Works2
default_status: unaffected
vendor: Mitsubishi Electric
product: GX Works3
default_status: unaffected
vendor: Mitsubishi Electric
product: M_CommDTM-IO-Link
default_status: unaffected
vendor: Mitsubishi Electric
product: MELFA-Works
default_status: unaffected
vendor: Mitsubishi Electric
product: MELSEC WinCPU Setting Utility
default_status: unaffected
vendor: Mitsubishi Electric
product: MELSOFT Complete Clean Up Tool
default_status: unaffected
vendor: Mitsubishi Electric
product: MELSOFT EM Software Development Kit
default_status: unaffected
vendor: Mitsubishi Electric
product: MELSOFT iQ AppPortal
default_status: unaffected
vendor: Mitsubishi Electric
product: MELSOFT Navigator
default_status: unaffected
vendor: Mitsubishi Electric
product: MI Configurator
default_status: unaffected
vendor: Mitsubishi Electric
product: Motion Control Setting
default_status: unaffected
vendor: Mitsubishi Electric
product: Motorizer
default_status: unaffected
vendor: Mitsubishi Electric
product: MR Configurator2
default_status: unaffected
vendor: Mitsubishi Electric
product: MT Works2
default_status: unaffected
vendor: Mitsubishi Electric
product: MTConnect Data Collector
default_status: unaffected
vendor: Mitsubishi Electric
product: MX Component
default_status: unaffected
vendor: Mitsubishi Electric
product: MX MESInterface
default_status: unaffected
vendor: Mitsubishi Electric
product: MX MESInterface-R
default_status: unaffected
vendor: Mitsubishi Electric
product: MX Sheet
default_status: unaffected
vendor: Mitsubishi Electric
product: Network Interface Board CC IE Control Utility
default_status: unaffected
vendor: Mitsubishi Electric
product: Network Interface Board CC IE Field Utility
default_status: unaffected
vendor: Mitsubishi Electric
product: Network Interface Board CC-Link Ver.2 Utility
default_status: unaffected
vendor: Mitsubishi Electric
product: Network Interface Board MNETH Utility
default_status: unaffected
vendor: Mitsubishi Electric
product: Position Board utility 2
default_status: unaffected
vendor: Mitsubishi Electric
product: PX Developer
default_status: unaffected
vendor: Mitsubishi Electric
product: RT ToolBox2
default_status: unaffected
vendor: Mitsubishi Electric
product: RT ToolBox3
default_status: unaffected
vendor: Mitsubishi Electric
product: Setting/Monitoring tools for the C Controller module
default_status: unaffected
vendor: Mitsubishi Electric
product: SLMP Data Collector
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Mashav Sapir of Claroty reported this vulnerability to CISA
Published: 2022-02-11T17:40:28.403Z