by Kastro
Paper/Archive/CVE-2020-14521

CVE-2020-14521

Mitsubishi Electric C Controller Interface Module Utility — Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.4.704 × 2014.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.

Affected

ProductAffectedFixed inSource
C Controller Interface Module Utilityunspecified – Version 2.00–CNA
CC-Link IE Control Network Data CollectorVersion 1.00A–CNA
CC-Link IE Field Network Data CollectorVersion 1.00A–CNA
CC-Link IE TSN Data CollectorVersion 1.00A–CNA
CPU Module Logging Configuration Toolunspecified – Version 1.100E–CNA
CW Configuratorunspecified – Version 1.010L–CNA
Data Transferunspecified – Version 3.42U–CNA
EZSocketunspecified – Version 5.1–CNA
FR Configurator SW3All Versions–CNA
FR Configurator2unspecified – Version 1.26C–CNA
GT Designer2 ClassicAll Versions–CNA
GT Designer3 Version1 (GOT1000)unspecified – Version 1.241B–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)8.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-20-212-04advisorymitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf