Heap-based buffer overflow in Mitsubishi Electric Corporation CPU Module Logging…
Priority MEDIUM 49CWE-122Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions 1.011M and prior, Data Transfer versions 3.44W and prior, EZSocket versions 5.4 and prior, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 versions 1.24A and prior, GT Designer3 Version1(GOT1000) versions 1.250L and prior, GT Designer3 Version1(GOT2000) versions 1.250L and prior, GT SoftGOT1000 Version3 versions 3.245F and prior, GT SoftGOT2000 Version1 versions 1.250L and prior, GX Configurator-DP versions 7.14Q and prior, GX Configurator-QP all versions, GX Developer versions 8.506C and prior, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer versions 1.115U and prior, GX RemoteService-I all versions, GX Works2 versions 1.597X and prior, GX Works3 versions 1.070Y and prior, iQ Monozukuri ANDON (Data Transfer) versions 1.003D and prior, iQ Monozukuri Process Remote Monitoring (Data Transfer) versions 1.002C and prior, M_CommDTM-HART all versions, M_CommDTM-IO-Link versions 1.03D and prior, MELFA-Works versions 4.4 and prior, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Development Kit (EM Configurator) versions 1.015R and prior, MELSOFT Navigator versions 2.74C and prior, MH11 SettingTool Version2 versions 2.004E and prior, MI Configurator versions 1.004E and prior, MT Works2 versions 1.167Z and prior, MX Component versions 5.001B and prior, Network Interface Board CC IE Control utility versions 1.29F and prior, Network Interface Board CC IE Field Utility versions 1.16S and prior, Network Interface Board CC-Link Ver.2 Utility versions 1.23Z and prior, Network Interface Board MNETH utility versions 34L and prior, PX Developer versions 1.53F and prior, RT ToolBox2 versions 3.73B and prior, RT ToolBox3 versions 1.82L and prior, Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) versions 4.12N and prior, and SLMP Data Collector versions 1.04E and prior) allows a remote unauthenticated attacker to cause a DoS condition on the software products, and possibly to execute a malicious code on the personal computer running the software products although it has not been reproduced, by spoofing MELSEC, GOT or FREQROL and returning crafted reply packets.
Why it matters now
EPSS 0.03886 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Mitsubishi Electric Corporation | CPU Module Logging Configuration Tool | up to 1.112R | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | CW Configurator | up to 1.011M | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Data Transfer | up to 3.44W | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | EZSocket | up to 5.4 | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | FR Configurator | all versions | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | FR Configurator SW3 | all versions | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | FR Configurator2 | up to 1.24A | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT Designer3 Version1(GOT1000) | up to 1.250L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT Designer3 Version1(GOT2000) | up to 1.250L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT SoftGOT1000 Version3 | up to 3.245F | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GT SoftGOT2000 Version1 | up to 1.250L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Configurator-DP | up to 7.14Q | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Configurator-QP | all versions | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Developer | up to 8.506C | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Explorer | all versions | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX IEC Developer | all versions | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX LogViewer | up to 1.115U | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX RemoteService-I | all versions | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Works2 | up to 1.597X | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | GX Works3 | up to 1.070Y | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | iQ Monozukuri ANDON (Data Transfer) | up to 1.003D | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | iQ Monozukuri Process Remote Monitoring (Data Transfer) | up to 1.002C | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | M_CommDTM-HART | all versions | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | M_CommDTM-IO-Link | up to 1.03D | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELFA-Works | up to 4.4 | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSEC WinCPU Setting Utility | all versions | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSOFT EM Software Development Kit (EM Configurator) | up to 1.015R | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MELSOFT Navigator | up to 2.74C | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MH11 SettingTool Version2 | up to 2.004E | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MI Configurator | up to 1.004E | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MT Works2 | up to 1.167Z | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | MX Component | up to 5.001B | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Network Interface Board CC IE Control utility | up to 1.29F | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Network Interface Board CC IE Field Utility | up to 1.16S | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Network Interface Board CC-Link Ver.2 Utility | up to 1.23Z | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Network Interface Board MNETH utility | up to 34L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | PX Developer | up to 1.53F | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | RT ToolBox2 | up to 3.73B | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | RT ToolBox3 | up to 1.82L | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) | up to 4.12N | — | No fix listed | CNA |
| Mitsubishi Electric Corporation | SLMP Data Collector | up to 1.04E | — | No fix listed | CNA |
- CPU Module Logging Configuration Tool VendorMitsubishi Electric Corporation Affected up to 1.112R Fixed in — No fix listed CNA
- CW Configurator VendorMitsubishi Electric Corporation Affected up to 1.011M Fixed in — No fix listed CNA
- Data Transfer VendorMitsubishi Electric Corporation Affected up to 3.44W Fixed in — No fix listed CNA
- EZSocket VendorMitsubishi Electric Corporation Affected up to 5.4 Fixed in — No fix listed CNA
- FR Configurator VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
- FR Configurator SW3 VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
- FR Configurator2 VendorMitsubishi Electric Corporation Affected up to 1.24A Fixed in — No fix listed CNA
- GT Designer3 Version1(GOT1000) VendorMitsubishi Electric Corporation Affected up to 1.250L Fixed in — No fix listed CNA
- GT Designer3 Version1(GOT2000) VendorMitsubishi Electric Corporation Affected up to 1.250L Fixed in — No fix listed CNA
- GT SoftGOT1000 Version3 VendorMitsubishi Electric Corporation Affected up to 3.245F Fixed in — No fix listed CNA
- GT SoftGOT2000 Version1 VendorMitsubishi Electric Corporation Affected up to 1.250L Fixed in — No fix listed CNA
- GX Configurator-DP VendorMitsubishi Electric Corporation Affected up to 7.14Q Fixed in — No fix listed CNA
- GX Configurator-QP VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
- GX Developer VendorMitsubishi Electric Corporation Affected up to 8.506C Fixed in — No fix listed CNA
- GX Explorer VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
- GX IEC Developer VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
- GX LogViewer VendorMitsubishi Electric Corporation Affected up to 1.115U Fixed in — No fix listed CNA
- GX RemoteService-I VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
- GX Works2 VendorMitsubishi Electric Corporation Affected up to 1.597X Fixed in — No fix listed CNA
- GX Works3 VendorMitsubishi Electric Corporation Affected up to 1.070Y Fixed in — No fix listed CNA
- iQ Monozukuri ANDON (Data Transfer) VendorMitsubishi Electric Corporation Affected up to 1.003D Fixed in — No fix listed CNA
- iQ Monozukuri Process Remote Monitoring (Data Transfer) VendorMitsubishi Electric Corporation Affected up to 1.002C Fixed in — No fix listed CNA
- M_CommDTM-HART VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
- M_CommDTM-IO-Link VendorMitsubishi Electric Corporation Affected up to 1.03D Fixed in — No fix listed CNA
- MELFA-Works VendorMitsubishi Electric Corporation Affected up to 4.4 Fixed in — No fix listed CNA
- MELSEC WinCPU Setting Utility VendorMitsubishi Electric Corporation Affected all versions Fixed in — No fix listed CNA
- MELSOFT EM Software Development Kit (EM Configurator) VendorMitsubishi Electric Corporation Affected up to 1.015R Fixed in — No fix listed CNA
- MELSOFT Navigator VendorMitsubishi Electric Corporation Affected up to 2.74C Fixed in — No fix listed CNA
- MH11 SettingTool Version2 VendorMitsubishi Electric Corporation Affected up to 2.004E Fixed in — No fix listed CNA
- MI Configurator VendorMitsubishi Electric Corporation Affected up to 1.004E Fixed in — No fix listed CNA
- MT Works2 VendorMitsubishi Electric Corporation Affected up to 1.167Z Fixed in — No fix listed CNA
- MX Component VendorMitsubishi Electric Corporation Affected up to 5.001B Fixed in — No fix listed CNA
- Network Interface Board CC IE Control utility VendorMitsubishi Electric Corporation Affected up to 1.29F Fixed in — No fix listed CNA
- Network Interface Board CC IE Field Utility VendorMitsubishi Electric Corporation Affected up to 1.16S Fixed in — No fix listed CNA
- Network Interface Board CC-Link Ver.2 Utility VendorMitsubishi Electric Corporation Affected up to 1.23Z Fixed in — No fix listed CNA
- Network Interface Board MNETH utility VendorMitsubishi Electric Corporation Affected up to 34L Fixed in — No fix listed CNA
- PX Developer VendorMitsubishi Electric Corporation Affected up to 1.53F Fixed in — No fix listed CNA
- RT ToolBox2 VendorMitsubishi Electric Corporation Affected up to 3.73B Fixed in — No fix listed CNA
- RT ToolBox3 VendorMitsubishi Electric Corporation Affected up to 1.82L Fixed in — No fix listed CNA
- Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) VendorMitsubishi Electric Corporation Affected up to 4.12N Fixed in — No fix listed CNA
- SLMP Data Collector VendorMitsubishi Electric Corporation Affected up to 1.04E Fixed in — No fix listed CNA
CPE configurations NVD · 41
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mitsubishielectric:c_controller_module_setting_and_monitoring_tool:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:cpu_module_logging_configuration_tool:*:*:*:*:*:*:*:* | up to 1.112r | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:cw_configurator:*:*:*:*:*:*:*:* | up to 1.011m | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:data_transfer:*:*:*:*:*:*:*:* | up to 3.44w | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:fr_configurator:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:fr_configurator_sw3:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:* | up to 1.24a | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gt_designer3:*:*:*:*:*:*:*:* | up to 1.250l | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gt_softgot1000:*:*:*:*:*:*:*:* | up to 3.245f | Vulnerable | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:mitsubishielectric:c_controller_module_setting_and_monitoring_tool:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:cpu_module_logging_configuration_tool:*:*:*:*:*:*:*:* Versions up to 1.112r Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:cw_configurator:*:*:*:*:*:*:*:* Versions up to 1.011m Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:data_transfer:*:*:*:*:*:*:*:* Versions up to 3.44w Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:ezsocket:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:fr_configurator:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:fr_configurator_sw3:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:fr_configurator2:*:*:*:*:*:*:*:* Versions up to 1.24a Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gt_designer3:*:*:*:*:*:*:*:* Versions up to 1.250l Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gt_softgot1000:*:*:*:*:*:*:*:* Versions up to 3.245f Vulnerable ·Mitsubishi Electric Europe B.V.
Show 31 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:* | up to 1.250l | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_configurator-dp:*:*:*:*:*:*:*:* | up to 7.14q | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_configurator-qp:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_developer:*:*:*:*:*:*:*:* | up to 8.506c | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_explorer:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_iec_developer:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_logviewer:*:*:*:*:*:*:*:* | up to 1.115u | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_remoteservice-i:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:* | up to 1.597x | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:* | up to 1.070y | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:iq_monozukuri_andon:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:iq_monozukuri_process_remote_monitoring:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:m_commdtm-hart:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:m_commdtm-io-link:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melfa-works:*:*:*:*:*:*:*:* | up to 4.4 | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melsec_wincpu_setting_utility:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melsoft_em_software_development_kit:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:* | up to 2.74c | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mh11_settingtool_version2:*:*:*:*:*:*:*:* | up to 2.004e | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mi_configurator:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:* | up to 1.167z | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:* | up to 5.001b | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:network_interface_board_cc-link:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_control_utility:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_field_utility:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:network_interface_board_mneth_utility:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:px_developer:*:*:*:*:*:*:*:* | up to 1.53f | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:rt_toolbox2:*:*:*:*:*:*:*:* | up to 3.73b | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:rt_toolbox3:*:*:*:*:*:*:*:* | up to 1.82l | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:setting\/monitoring_tools_for_the_c_controller_module:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mitsubishi Electric Europe B.V. |
| cpe:2.3:a:mitsubishielectric:slmp_data_collector:*:*:*:*:*:*:*:* | up to 1.04e | Vulnerable | Mitsubishi Electric Europe B.V. |
- cpe:2.3:a:mitsubishielectric:gt_softgot2000:*:*:*:*:*:*:*:* Versions up to 1.250l Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_configurator-dp:*:*:*:*:*:*:*:* Versions up to 7.14q Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_configurator-qp:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_developer:*:*:*:*:*:*:*:* Versions up to 8.506c Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_explorer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_iec_developer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_logviewer:*:*:*:*:*:*:*:* Versions up to 1.115u Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_remoteservice-i:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:* Versions up to 1.597x Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:* Versions up to 1.070y Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:iq_monozukuri_andon:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:iq_monozukuri_process_remote_monitoring:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:m_commdtm-hart:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:m_commdtm-io-link:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melfa-works:*:*:*:*:*:*:*:* Versions up to 4.4 Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melsec_wincpu_setting_utility:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melsoft_em_software_development_kit:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:* Versions up to 2.74c Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mh11_settingtool_version2:*:*:*:*:*:*:*:* Versions up to 2.004e Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mi_configurator:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:* Versions up to 1.167z Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:mx_component:*:*:*:*:*:*:*:* Versions up to 5.001b Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:network_interface_board_cc-link:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_control_utility:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:network_interface_board_cc_ie_field_utility:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:network_interface_board_mneth_utility:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:px_developer:*:*:*:*:*:*:*:* Versions up to 1.53f Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:rt_toolbox2:*:*:*:*:*:*:*:* Versions up to 3.73b Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:rt_toolbox3:*:*:*:*:*:*:*:* Versions up to 1.82l Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:setting\/monitoring_tools_for_the_c_controller_module:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mitsubishi Electric Europe B.V.
- cpe:2.3:a:mitsubishielectric:slmp_data_collector:*:*:*:*:*:*:*:* Versions up to 1.04e Vulnerable ·Mitsubishi Electric Europe B.V.
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Mitsubishi Electric CPU Module Logging Configuration Tool, CW Configurator and 39 more products — mitsubishielectric.com/psirt/vulnerability/pdf/2020-021_en.…
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration ToolPriority MEDIUM 52
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20587
- 2026-10-03 Alias added: GHSA-66m6-mhcr-vj8v
- 2026-10-13 EPSS moved to the 90th–95th percentile
References
Advisory 4
More Mitsubishi Electric Corporation vulnerabilities
- TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
- TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
- TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
- TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
- TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
- TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
Sources
- CVE-2021-20587 · CVE Program
- CVE-2021-20587 · NVD
- FIRST EPSS
- GHSA-66m6-mhcr-vj8v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences