Skip to content
Fencer Vulns
high 8.3

CVE-2020-14521 json

Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element

published 2022-02-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2020-6657

cvss
8.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-212-04 updated cvss 8.3

Mitsubishi Electric Factory Automation Engineering Products (Update L)

  • Mitsubishi Electric C Controller Interface Module utility <=2.00 Mitsubishi Electric CC-Link IE Control Network Data Collector 1.00A Mitsubishi Electric CC-Link IE Field Network Data Collector 1.00A Mitsubishi Electric CC-Link IE TSN Data Collector 1.00A Mitsubishi Electric CPU Module Logging Configuration Tool <=1.100E Mitsubishi Electric CW Configurator <=1.010L
    +2 more products
    Mitsubishi Electric Data Transfer <=3.42U Mitsubishi Electric EZSocket <=5.1
    affected: vendor fix, mitigation mitsubishielectric.com
  • Mitsubishi Electric FR Configurator SW3
    affected: mitigation, no fix planned mitsubishielectric.com
  • Mitsubishi Electric FR Configurator2 <=1.26C
    affected: vendor fix, mitigation mitsubishielectric.com
  • Mitsubishi Electric GT Designer2 Classic
    affected: mitigation, no fix planned mitsubishielectric.com
  • Mitsubishi Electric GT Designer3 Version1 (GOT1000) <=1.241B Mitsubishi Electric GT Designer3 Version1 (GOT2000) <=1.241B Mitsubishi Electric GT SoftGOT1000 Version3 <=3.200J Mitsubishi Electric GT SoftGOT2000 Version1 <=1.241B Mitsubishi Electric GX Developer <=8.504A Mitsubishi Electric GX LogViewer <=1.100E
    +4 more products
    Mitsubishi Electric GX Works2 <=1.601B Mitsubishi Electric GX Works3 <=1.063R Mitsubishi Electric M_CommDTM-IO-Link <=1.03D Mitsubishi Electric MELFA-Works <=4.4
    affected: vendor fix, mitigation mitsubishielectric.com
  • Mitsubishi Electric MELSEC WinCPU Setting Utility
    affected: mitigation, no fix planned mitsubishielectric.com
  • Mitsubishi Electric MELSOFT Complete Clean Up Tool <=1.06G Mitsubishi Electric MELSOFT EM Software Development Kit <=1.015R Mitsubishi Electric MELSOFT iQ AppPortal <=1.17T Mitsubishi Electric MELSOFT Navigator <=2.74C Mitsubishi Electric MI Configurator <=1.004E Mitsubishi Electric Motion Control Setting <=1.005F
    +12 more products
    Mitsubishi Electric Motorizer <=1.005F Mitsubishi Electric MR Configurator2 <=1.125F Mitsubishi Electric MT Works2 <=1.167Z Mitsubishi Electric MTConnect Data Collector <=1.1.4.0 Mitsubishi Electric MX Component <=4.20W Mitsubishi Electric MX MESInterface <=1.21X Mitsubishi Electric MX MESInterface-R <=1.12N Mitsubishi Electric MX Sheet <=2.15R Mitsubishi Electric Network Interface Board CC IE Control Utility <=1.29F Mitsubishi Electric Network Interface Board CC IE Field Utility <=1.16S Mitsubishi Electric Network Interface Board CC-Link Ver.2 Utility <=1.23Z Mitsubishi Electric Network Interface Board MNETH Utility <=34L
    affected: vendor fix, mitigation mitsubishielectric.com

14 more affected in the full advisory

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Mitsubishi Electric C Controller Interface Module Utility
  • Mitsubishi Electric CC-Link IE Control Network Data Collector
  • Mitsubishi Electric CC-Link IE Field Network Data Collector
  • Mitsubishi Electric CC-Link IE TSN Data Collector
  • Mitsubishi Electric CPU Module Logging Configuration Tool
  • Mitsubishi Electric CW Configurator
  • Mitsubishi Electric Data Transfer
  • Mitsubishi Electric EZSocket
  • Mitsubishi Electric FR Configurator SW3
  • Mitsubishi Electric FR Configurator2
  • Mitsubishi Electric GT Designer2 Classic
  • Mitsubishi Electric GT Designer3 Version1 (GOT1000)
  • Mitsubishi Electric GT Designer3 Version1 (GOT2000)
  • Mitsubishi Electric GT SoftGOT1000 Version3
  • Mitsubishi Electric GT SoftGOT2000 Version1
  • Mitsubishi Electric GX Developer
  • Mitsubishi Electric GX LogViewer
  • Mitsubishi Electric GX Works2
  • Mitsubishi Electric GX Works3
  • Mitsubishi Electric M_CommDTM-IO-Link
  • Mitsubishi Electric MELFA-Works
  • Mitsubishi Electric MELSEC WinCPU Setting Utility
  • Mitsubishi Electric MELSOFT Complete Clean Up Tool
  • Mitsubishi Electric MELSOFT EM Software Development Kit
  • Mitsubishi Electric MELSOFT iQ AppPortal
  • Mitsubishi Electric MELSOFT Navigator
  • Mitsubishi Electric MI Configurator
  • Mitsubishi Electric Motion Control Setting
  • Mitsubishi Electric Motorizer
  • Mitsubishi Electric MR Configurator2
  • Mitsubishi Electric MT Works2
  • Mitsubishi Electric MTConnect Data Collector
  • Mitsubishi Electric MX Component
  • Mitsubishi Electric MX MESInterface
  • Mitsubishi Electric MX MESInterface-R
  • Mitsubishi Electric MX Sheet
  • Mitsubishi Electric Network Interface Board CC IE Control Utility
  • Mitsubishi Electric Network Interface Board CC IE Field Utility
  • Mitsubishi Electric Network Interface Board CC-Link Ver.2 Utility
  • Mitsubishi Electric Network Interface Board MNETH Utility
  • Mitsubishi Electric Position Board utility 2
  • Mitsubishi Electric PX Developer
  • Mitsubishi Electric RT ToolBox2
  • Mitsubishi Electric RT ToolBox3
  • Mitsubishi Electric Setting/Monitoring tools for the C Controller module
  • Mitsubishi Electric SLMP Data Collector

Classification

Weakness
  • CWE-428 Unquoted Search Path or Element
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.