What is CVE-2020-14496?

CVE-2020-14496 is a vulnerability that allows an attacker to escalate privilege and execute malicious programs in multiple Mitsubishi Electric Factory Automation Engineering Software Products.

How severe is CVE-2020-14496?

CVE-2020-14496 has a severity rating of 9.8, which is considered critical.

Which Mitsubishi Electric software products are affected by CVE-2020-14496?

The following Mitsubishi Electric software products are affected: CPU Module Logging Configuration Tool, CW Configurator, Data Transfer, EM Configurator, EZSocket, FR Configurator2, GT Designer3, GT SoftGOT1000, GT SoftGOT2000, GX LogViewer, GX Works2, GX Works3, M Commdtm-HART, M Commdtm-IO-Link, MELFA-Works, Melsoft Fielddeviceconfigurator, Melsoft Navigator, MH11 Settingtool Version2, Motorizer, MR Configurator2, MT Works2, MX Component, Network Interface Board CC-Link Ver.2 Utility, Network Interface Board CC IE Control Utility, Network Interface Board CC IE Field Utility, Network Interface Board MNETH Utility, PX Developer, RT Toolbox2, and RT Toolbox3.

What can an attacker do if they exploit CVE-2020-14496?

If CVE-2020-14496 is successfully exploited, an attacker can escalate privilege, execute malicious programs, cause a denial-of-service condition, and access information.

Is there a fix available for CVE-2020-14496?

It is recommended to apply the latest patches and updates provided by Mitsubishi Electric to fix CVE-2020-14496.

Vulnerability/
CVE-2020-14496

critical

9.8

CWE

275

19/5/2022

7/6/2022

CVE-2020-14496

First published: Thu May 19 2022(Updated: )

Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information to be disclosed, tampered with, and/or destroyed.

Credit: ics-cert@hq.dhs.gov

Affected Software	Affected Version	How to fix
Mitsubishielectric Cpu Module Logging Configuration Tool	<1.106k
Mitsubishielectric Cw Configurator	<1.011m
Mitsubishielectric Data Transfer	<3.41t
Mitsubishielectric Em Configurator	<1.015r
Mitsubishielectric Ezsocket	<4.6
Mitsubishielectric Fr Configurator2	<1.23z
Mitsubishielectric Gt Designer3	<1.236w
Mitsubishielectric Gt Softgot1000	<3.245f
Mitsubishielectric Gt Softgot2000	<1.236w
Mitsubishielectric Gx Logviewer	<1.106k
Mitsubishielectric Gx Works2	<1.595v
Mitsubishielectric Gx Works3	<1.065t
Mitsubishielectric M Commdtm-hart	<1.01b
Mitsubishielectric M Commdtm-io-link	<1.04e
Mitsubishielectric Melfa-works	<4.4
Mitsubishielectric Melsoft Fielddeviceconfigurator	<1.04e
Mitsubishielectric Melsoft Navigator	<2.70y
Mitsubishielectric Mh11 Settingtool Version2	<2.003d
Mitsubishielectric Motorizer	<1.010l
Mitsubishielectric Mr Configurator2	<1.106l
Mitsubishielectric Mt Works2	<1.160s
Mitsubishielectric Mx Component	<4.20w
Mitsubishielectric Network Interface Board Cc-link Ver.2 Utility	<1.24a
Mitsubishielectric Network Interface Board Cc Ie Control Utility	<1.30g
Mitsubishielectric Network Interface Board Cc Ie Field Utility	<1.17t
Mitsubishielectric Network Interface Board Mneth Utility	<35m
Mitsubishielectric Px Developer	<1.53f
Mitsubishielectric Rt Toolbox2	<3.73b
Mitsubishielectric Rt Toolbox3	<1.80j

Never miss a vulnerability like this again

Reference Links

https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-02

Frequently Asked Questions

What is CVE-2020-14496?
CVE-2020-14496 is a vulnerability that allows an attacker to escalate privilege and execute malicious programs in multiple Mitsubishi Electric Factory Automation Engineering Software Products.
How severe is CVE-2020-14496?
CVE-2020-14496 has a severity rating of 9.8, which is considered critical.
Which Mitsubishi Electric software products are affected by CVE-2020-14496?
The following Mitsubishi Electric software products are affected: CPU Module Logging Configuration Tool, CW Configurator, Data Transfer, EM Configurator, EZSocket, FR Configurator2, GT Designer3, GT SoftGOT1000, GT SoftGOT2000, GX LogViewer, GX Works2, GX Works3, M Commdtm-HART, M Commdtm-IO-Link, MELFA-Works, Melsoft Fielddeviceconfigurator, Melsoft Navigator, MH11 Settingtool Version2, Motorizer, MR Configurator2, MT Works2, MX Component, Network Interface Board CC-Link Ver.2 Utility, Network Interface Board CC IE Control Utility, Network Interface Board CC IE Field Utility, Network Interface Board MNETH Utility, PX Developer, RT Toolbox2, and RT Toolbox3.
What can an attacker do if they exploit CVE-2020-14496?
If CVE-2020-14496 is successfully exploited, an attacker can escalate privilege, execute malicious programs, cause a denial-of-service condition, and access information.
Is there a fix available for CVE-2020-14496?
It is recommended to apply the latest patches and updates provided by Mitsubishi Electric to fix CVE-2020-14496.