by Kastro
Paper/Archive/CVE-2020-14523

CVE-2020-14523

Mitsubishi Electric CW Configurator — Mitsubishi Electric Factory Automation Products Path Traversal

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 82.9.829 × 2016.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.

Affected

ProductAffectedFixed inSource
CW Configuratorunspecified – Version 1.010L–CNA
FR Configurator2unspecified – Version 1.22Y–CNA
GX Works2unspecified – Version 1.595V–CNA
GX Works3unspecified – Version 1.063R–CNA
MELSOFT iQ AppPortalunspecified – Version 1.17T–CNA
MELSOFT Navigatorunspecified – Version2.70Y–CNA
MI ConfiguratorAll Versions–CNA
MR Configurator2unspecified – Version 1.110Q–CNA
MT Works2unspecified – Versions 1.156N–CNA
MX Componentunspecified – Version 4.20W–CNA
RT ToolBox3unspecified – Versions 1.70Y–CNA
MELSEC iQ-R Series Motion Moduleunspecified – Versions 10–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)8.3CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-20-212-03refmitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdfrefjvn.jp/vu/JVNVU90224831