CVE-2020-14521

Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element

State: Published
Severity: 8.3 High
Published: Feb 11, 2022
Updated: Apr 16, 2025
Reserved: Jun 19, 2020

Description

Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	icscert

Weaknesses

CWE-428 Unquoted Search Path or Element

Affected Products

Product	Versions
C Controller Interface Module UtilityMitsubishi Electric	Version 2.00 and earlierAffected
CC-Link IE Control Network Data CollectorMitsubishi Electric	Version 1.00AAffected
CC-Link IE Field Network Data CollectorMitsubishi Electric	Version 1.00AAffected
CC-Link IE TSN Data CollectorMitsubishi Electric	Version 1.00AAffected
CPU Module Logging Configuration ToolMitsubishi Electric	Version 1.100E and earlierAffected
CW ConfiguratorMitsubishi Electric	Version 1.010L and earlierAffected
Data TransferMitsubishi Electric	Version 3.42U and earlierAffected
EZSocketMitsubishi Electric	Version 5.1 and earlierAffected
FR Configurator SW3Mitsubishi Electric	All VersionsAffected
FR Configurator2Mitsubishi Electric	Version 1.26C and earlierAffected
GT Designer2 ClassicMitsubishi Electric	All VersionsAffected
GT Designer3 Version1 (GOT1000)Mitsubishi Electric	Version 1.241B and earlierAffected
GT Designer3 Version1 (GOT2000)Mitsubishi Electric	Version 1.241B and earlierAffected
GT SoftGOT1000 Version3Mitsubishi Electric	Version 3.200J and earlierAffected
GT SoftGOT2000 Version1Mitsubishi Electric	Version 1.241B and earlierAffected
GX DeveloperMitsubishi Electric	Version 8.504A and earlierAffected
GX LogViewerMitsubishi Electric	Version 1.100E and earlierAffected
GX Works2Mitsubishi Electric	Version 1.601B and earlierAffected
GX Works3Mitsubishi Electric	Version 1.063R and earlierAffected
M_CommDTM-IO-LinkMitsubishi Electric	Version 1.03D and earlierAffected
MELFA-WorksMitsubishi Electric	Version 4.4 and earlierAffected
MELSEC WinCPU Setting UtilityMitsubishi Electric	All VersionsAffected
MELSOFT Complete Clean Up ToolMitsubishi Electric	Version 1.06G and earlierAffected
MELSOFT EM Software Development KitMitsubishi Electric	Version 1.015R and earlierAffected
MELSOFT iQ AppPortalMitsubishi Electric	Version 1.17T and earlierAffected
MELSOFT NavigatorMitsubishi Electric	Version 2.74C and earlierAffected
MI ConfiguratorMitsubishi Electric	Version 1.004E and earlierAffected
Motion Control SettingMitsubishi Electric	Version 1.005F and earlierAffected
MotorizerMitsubishi Electric	Version 1.005F and earlierAffected
MR Configurator2Mitsubishi Electric	Version 1.125F and earlierAffected
MT Works2Mitsubishi Electric	Version 1.167Z and earlierAffected
MTConnect Data CollectorMitsubishi Electric	Version 1.1.4.0 and earlierAffected
MX ComponentMitsubishi Electric	Version 4.20W and earlierAffected
MX MESInterfaceMitsubishi Electric	Version 1.21X and earlierAffected
MX MESInterface-RMitsubishi Electric	Version 1.12N and earlierAffected
MX SheetMitsubishi Electric	Version 2.15R and earlierAffected
Network Interface Board CC IE Control UtilityMitsubishi Electric	Version 1.29F and earlierAffected
Network Interface Board CC IE Field UtilityMitsubishi Electric	Versions 1.16S and earlierAffected
Network Interface Board CC-Link Ver.2 UtilityMitsubishi Electric	Version 1.23Z and earlierAffected
Network Interface Board MNETH UtilityMitsubishi Electric	Version 34L and earlierAffected
Position Board utility 2Mitsubishi Electric	Version 3.20 and earlierAffected
PX DeveloperMitsubishi Electric	Version 1.53F and earlierAffected
RT ToolBox2Mitsubishi Electric	Version 3.73B and earlierAffected
RT ToolBox3Mitsubishi Electric	Version 1.82L and earlierAffected
Setting/Monitoring tools for the C Controller moduleMitsubishi Electric	SW3PVC-CCPU Version 3.13P and earlierAffected SW4PVC-CCPU Version 4.12N and earlierAffected
SLMP Data CollectorMitsubishi Electric	Version 1.04E and earlierAffected

References

https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-04government-resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdfvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.