Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues
Priority MEDIUM 44CWE-275Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information to be disclosed, tampered with, and/or destroyed.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00867 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mitsubishi Electric Corporation | CPU Module Logging Configuration Tool | All – 1.100E | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | CW Configurator | All – 1.010L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Data Transfer | All – 3.40S | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | EZSocket | All – 4.5 | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | FR Configurator2 | All – 1.22Y | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT Designer3 Version1 (GOT2000) | All – 1.235V | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT SoftGOT1000 Version3 | All – 3.200J | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT SoftGOT1000 Version3 | All | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT SoftGOT2000 Version1 | All – 1.235V | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX LogViewer | All – 1.100E | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Works2 | All – 1.592S | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Works3 | All – 1.063R | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | M_CommDTM-HART | All 1.00A | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | M_CommDTM-IO-Link | All | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELFA-Works | All – 4.3 | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC WinCPU Setting Utility | All | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSOFT EM Software Development Kit (EM Configurator) | All – 1.010L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSOFT FieldDeviceConfigurator | All – 1.03D | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSOFT Navigator | All – 2.62Q | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MH11 SettingTool Version2 | All – 2.002C | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MI Configurator | All | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Motorizer | All – 1.005F | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MR Configurator2 | All – 1.105K | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MT Works2 | All – 1.156N | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MX Component | All – 4.19V | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Network Interface Board CC IE Control utility | All | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Network Interface Board CC IE Field Utility | All | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Network Interface Board CC-Link Ver.2 Utility | All | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Network Interface Board MNETH utility | All | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | PX Developer | All – 1.52E | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | RT ToolBox2 | All – 3.72A | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | RT ToolBox3 | All – 1.70Y | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Setting/monitoring tools for the C Controller module | All | — | No fix listed | CNA |
- CPU Module Logging Configuration Tool VendorMitsubishi Electric Corporation Affected All – 1.100E Fixed in — No fix listed CNA
- CW Configurator VendorMitsubishi Electric Corporation Affected All – 1.010L Fixed in — No fix listed CNA
- Data Transfer VendorMitsubishi Electric Corporation Affected All – 3.40S Fixed in — No fix listed CNA
- EZSocket VendorMitsubishi Electric Corporation Affected All – 4.5 Fixed in — No fix listed CNA
- FR Configurator2 VendorMitsubishi Electric Corporation Affected All – 1.22Y Fixed in — No fix listed CNA
- GT Designer3 Version1 (GOT2000) VendorMitsubishi Electric Corporation Affected All – 1.235V Fixed in — No fix listed CNA
- GT SoftGOT1000 Version3 VendorMitsubishi Electric Corporation Affected All – 3.200J Fixed in — No fix listed CNA
- GT SoftGOT1000 Version3 VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
- GT SoftGOT2000 Version1 VendorMitsubishi Electric Corporation Affected All – 1.235V Fixed in — No fix listed CNA
- GX LogViewer VendorMitsubishi Electric Corporation Affected All – 1.100E Fixed in — No fix listed CNA
- GX Works2 VendorMitsubishi Electric Corporation Affected All – 1.592S Fixed in — No fix listed CNA
- GX Works3 VendorMitsubishi Electric Corporation Affected All – 1.063R Fixed in — No fix listed CNA
- M_CommDTM-HART VendorMitsubishi Electric Corporation Affected All 1.00A Fixed in — No fix listed CNA
- M_CommDTM-IO-Link VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
- MELFA-Works VendorMitsubishi Electric Corporation Affected All – 4.3 Fixed in — No fix listed CNA
- MELSEC WinCPU Setting Utility VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
- MELSOFT EM Software Development Kit (EM Configurator) VendorMitsubishi Electric Corporation Affected All – 1.010L Fixed in — No fix listed CNA
- MELSOFT FieldDeviceConfigurator VendorMitsubishi Electric Corporation Affected All – 1.03D Fixed in — No fix listed CNA
- MELSOFT Navigator VendorMitsubishi Electric Corporation Affected All – 2.62Q Fixed in — No fix listed CNA
- MH11 SettingTool Version2 VendorMitsubishi Electric Corporation Affected All – 2.002C Fixed in — No fix listed CNA
- MI Configurator VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
- Motorizer VendorMitsubishi Electric Corporation Affected All – 1.005F Fixed in — No fix listed CNA
- MR Configurator2 VendorMitsubishi Electric Corporation Affected All – 1.105K Fixed in — No fix listed CNA
- MT Works2 VendorMitsubishi Electric Corporation Affected All – 1.156N Fixed in — No fix listed CNA
- MX Component VendorMitsubishi Electric Corporation Affected All – 4.19V Fixed in — No fix listed CNA
- Network Interface Board CC IE Control utility VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
- Network Interface Board CC IE Field Utility VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
- Network Interface Board CC-Link Ver.2 Utility VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
- Network Interface Board MNETH utility VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
- PX Developer VendorMitsubishi Electric Corporation Affected All – 1.52E Fixed in — No fix listed CNA
- RT ToolBox2 VendorMitsubishi Electric Corporation Affected All – 3.72A Fixed in — No fix listed CNA
- RT ToolBox3 VendorMitsubishi Electric Corporation Affected All – 1.70Y Fixed in — No fix listed CNA
- Setting/monitoring tools for the C Controller module VendorMitsubishi Electric Corporation Affected All Fixed in — No fix listed CNA
CPE configurations NVD · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mitsubishielectric:cpu_module_logging_configuration_tool:*:*:*:*:*:*:*:* | before 1.106k | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:cw_configurator:*:*:*:*:*:*:*:* | before 1.011m | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:data_transfer:*:*:*:*:*:*:*:* | before 3.41t | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:em_configurator:*:*:*:*:*:*:*:* | before 1.015r | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:* | before 4.6 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:* | before 1.23z | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gt_designer3:*:*:*:*:*:*:*:* | before 1.236w | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gt_softgot1000:*:*:*:*:*:*:*:* | before 3.245f | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:* | before 1.236w | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_logviewer:*:*:*:*:*:*:*:* | before 1.106k | Vulnerable | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:mitsubishielectric:cpu_module_logging_configuration_tool:*:*:*:*:*:*:*:* Versions before 1.106k Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:cw_configurator:*:*:*:*:*:*:*:* Versions before 1.011m Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:data_transfer:*:*:*:*:*:*:*:* Versions before 3.41t Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:em_configurator:*:*:*:*:*:*:*:* Versions before 1.015r Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:* Versions before 4.6 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:* Versions before 1.23z Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gt_designer3:*:*:*:*:*:*:*:* Versions before 1.236w Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gt_softgot1000:*:*:*:*:*:*:*:* Versions before 3.245f Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:* Versions before 1.236w Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_logviewer:*:*:*:*:*:*:*:* Versions before 1.106k Vulnerable ·Mitsubishi Electric Europe B.V.
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:* | before 1.595v | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:* | before 1.065t | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:m_commdtm-hart:*:*:*:*:*:*:*:* | before 1.01b | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:m_commdtm-io-link:*:*:*:*:*:*:*:* | before 1.04e | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melfa-works:*:*:*:*:*:*:*:* | before 4.4 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melsoft_fielddeviceconfigurator:*:*:*:*:*:*:*:* | before 1.04e | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:* | before 2.70y | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mh11_settingtool_version2:*:*:*:*:*:*:*:* | before 2.003d | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:motorizer:*:*:*:*:*:*:*:* | before 1.010l | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mr_configurator2:*:*:*:*:*:*:*:* | before 1.106l | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:* | before 1.160s | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:* | before 4.20w | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:network_interface_board_cc-link_ver.2_utility:*:*:*:*:*:*:*:* | before 1.24a | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_control_utility:*:*:*:*:*:*:*:* | before 1.30g | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_field_utility:*:*:*:*:*:*:*:* | before 1.17t | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:network_interface_board_mneth_utility:*:*:*:*:*:*:*:* | before 35m | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:px_developer:*:*:*:*:*:*:*:* | before 1.53f | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:rt_toolbox2:*:*:*:*:*:*:*:* | before 3.73b | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:rt_toolbox3:*:*:*:*:*:*:*:* | before 1.80j | Vulnerable | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:* Versions before 1.595v Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:* Versions before 1.065t Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:m_commdtm-hart:*:*:*:*:*:*:*:* Versions before 1.01b Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:m_commdtm-io-link:*:*:*:*:*:*:*:* Versions before 1.04e Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melfa-works:*:*:*:*:*:*:*:* Versions before 4.4 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melsoft_fielddeviceconfigurator:*:*:*:*:*:*:*:* Versions before 1.04e Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:* Versions before 2.70y Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mh11_settingtool_version2:*:*:*:*:*:*:*:* Versions before 2.003d Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:motorizer:*:*:*:*:*:*:*:* Versions before 1.010l Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mr_configurator2:*:*:*:*:*:*:*:* Versions before 1.106l Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:* Versions before 1.160s Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:* Versions before 4.20w Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:network_interface_board_cc-link_ver.2_utility:*:*:*:*:*:*:*:* Versions before 1.24a Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_control_utility:*:*:*:*:*:*:*:* Versions before 1.30g Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_field_utility:*:*:*:*:*:*:*:* Versions before 1.17t Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:network_interface_board_mneth_utility:*:*:*:*:*:*:*:* Versions before 35m Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:px_developer:*:*:*:*:*:*:*:* Versions before 1.53f Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:rt_toolbox2:*:*:*:*:*:*:*:* Versions before 3.73b Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:rt_toolbox3:*:*:*:*:*:*:*:* Versions before 1.80j Vulnerable ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-14496
- 2026-10-03 Alias added: GHSA-j3qh-9fj7-j65q
References
More Mitsubishi Electric Corporation vulnerabilities
- TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
- TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
- TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
- TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
- TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
- TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-14496 · CVE Program
- CVE-2020-14496 · NVD
- FIRST EPSS
- GHSA-j3qh-9fj7-j65q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences