CVE-2020-14523

Mitsubishi Electric Factory Automation Products Path Traversal

State: Published
Severity: 8.3 High
Published: Feb 11, 2022
Updated: Apr 16, 2025
Reserved: Jun 19, 2020

Description

Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.

Scores

CVSS	Score	Vector	Source
3.1	8.3 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	icscert

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

Product	Versions
CW ConfiguratorMitsubishi Electric	Version 1.010L and earlierAffected
FR Configurator2Mitsubishi Electric	Version 1.22Y and earlierAffected
GX Works2Mitsubishi Electric	Version 1.595V and earlierAffected
GX Works3Mitsubishi Electric	Version 1.063R and earlierAffected
MELSOFT iQ AppPortalMitsubishi Electric	Version 1.17T and earlierAffected
MELSOFT NavigatorMitsubishi Electric	Version2.70Y and earlierAffected
MI ConfiguratorMitsubishi Electric	All VersionsAffected
MR Configurator2Mitsubishi Electric	Version 1.110Q and earlierAffected
MT Works2Mitsubishi Electric	Versions 1.156N and earlierAffected
MX ComponentMitsubishi Electric	Version 4.20W and earlierAffected
RT ToolBox3Mitsubishi Electric	Versions 1.70Y and earlierAffected
MELSEC iQ-R Series Motion ModuleMitsubishi Electric	Versions 10 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.