Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element

8.3 CVSS

Vulnerability Description

Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-14521

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Mashav Sapir of Claroty reported this vulnerability to CISA

References

More from Mitsubishi Electric

View All →

CVE-2022-40266

Denial-of-Service (DoS) Vulnerability in FTP Server Function on GOT2000 Series

Medium 5.3

CVE-2022-33320

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions...

High 7.8

CVE-2022-33319

Out-of-bounds Read vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to...

High 8.2

CVE-2022-33318

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions...

Critical 9.8

CVE-2022-33317

Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi...

High 7.8

Affected Vendor

Mitsubishi Electric

View all reports →

Affected Software

C Controller Interface Module Utility, CC-Link IE Control Network Data Collector, CC-Link IE Field Network Data Collector, CC-Link IE TSN Data Collector, CPU Module Logging Configuration Tool, CW Configurator, Data Transfer, EZSocket, FR Configurator SW3, FR Configurator2, GT Designer2 Classic, GT Designer3 Version1 (GOT1000), GT Designer3 Version1 (GOT2000), GT SoftGOT1000 Version3, GT SoftGOT2000 Version1, GX Developer, GX LogViewer, GX Works2, GX Works3, M_CommDTM-IO-Link, MELFA-Works, MELSEC WinCPU Setting Utility, MELSOFT Complete Clean Up Tool, MELSOFT EM Software Development Kit, MELSOFT iQ AppPortal, MELSOFT Navigator, MI Configurator, Motion Control Setting, Motorizer, MR Configurator2, MT Works2, MTConnect Data Collector, MX Component, MX MESInterface, MX MESInterface-R, MX Sheet, Network Interface Board CC IE Control Utility, Network Interface Board CC IE Field Utility, Network Interface Board CC-Link Ver.2 Utility, Network Interface Board MNETH Utility, Position Board utility 2, PX Developer, RT ToolBox2, RT ToolBox3, Setting/Monitoring tools for the C Controller module, SLMP Data Collector

Vulnerable Versions:

unspecified, Version 1.00A, All Versions