{"id":"CVE-2020-14523","state":"PUBLISHED","title":"Mitsubishi Electric Factory Automation Products Path Traversal","description":"Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.","publishedAt":"2022-02-11T17:40:29.187Z","updatedAt":"2025-04-16T18:01:22.616Z","severity":{"score":8.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","source":"icscert"},"assigner":"icscert","products":["Mitsubishi Electric CW Configurator","Mitsubishi Electric FR Configurator2","Mitsubishi Electric GX Works2","Mitsubishi Electric GX Works3","Mitsubishi Electric MELSOFT iQ AppPortal","Mitsubishi Electric MELSOFT Navigator","Mitsubishi Electric MI Configurator","Mitsubishi Electric MR Configurator2","Mitsubishi Electric MT Works2","Mitsubishi Electric MX Component","Mitsubishi Electric RT ToolBox3","Mitsubishi Electric MELSEC iQ-R Series Motion Module"],"affected":[{"vendor":"Mitsubishi Electric","product":"CW Configurator","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.010L","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"FR Configurator2","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.22Y","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"GX Works2","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.595V","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"GX Works3","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.063R","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MELSOFT iQ AppPortal","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.17T","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MELSOFT Navigator","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version2.70Y","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MI Configurator","versions":[{"version":"All Versions","status":"affected"}]},{"vendor":"Mitsubishi Electric","product":"MR Configurator2","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.110Q","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MT Works2","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Versions 1.156N","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MX Component","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 4.20W","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"RT ToolBox3","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Versions 1.70Y","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MELSEC iQ-R Series Motion Module","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Versions 10","versionType":"custom"}]}],"references":["https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-03","https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdf","https://jvn.jp/vu/JVNVU90224831/"],"weaknesses":["CWE-22"],"ingestedAt":"2026-10-29T19:46:33.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/14xxx/CVE-2020-14523.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2020-14523","state":"PUBLISHED","datePublished":"2022-02-11T17:40:29.187Z","dateUpdated":"2025-04-16T18:01:22.616Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2020-06-19T00:00:00.000Z"},"containers":{"cna":{"title":"Mitsubishi Electric Factory Automation Products Path Traversal","descriptions":[{"lang":"en","value":"Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code."}],"affected":[{"vendor":"Mitsubishi Electric","product":"CW Configurator","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.010L","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"FR Configurator2","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.22Y","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"GX Works2","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.595V","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"GX Works3","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.063R","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MELSOFT iQ AppPortal","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.17T","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MELSOFT Navigator","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version2.70Y","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MI Configurator","versions":[{"version":"All Versions","status":"affected"}]},{"vendor":"Mitsubishi Electric","product":"MR Configurator2","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 1.110Q","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MT Works2","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Versions 1.156N","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MX Component","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Version 4.20W","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"RT ToolBox3","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Versions 1.70Y","versionType":"custom"}]},{"vendor":"Mitsubishi Electric","product":"MELSEC iQ-R Series Motion Module","versions":[{"version":"unspecified","status":"affected","lessThanOrEqual":"Versions 10","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-03","tags":["x_refsource_MISC"]},{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdf","tags":["x_refsource_MISC"]},{"url":"https://jvn.jp/vu/JVNVU90224831/","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","dateUpdated":"2022-02-18T23:17:23.000Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6"},"credits":[{"lang":"en","value":"Mashav Sapir of Claroty reported this vulnerability to CISA"}],"datePublic":"2020-07-30T00:00:00.000Z","source":{"advisory":"ICSA-20-212-03","discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.0.9"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","DATE_PUBLIC":"2020-07-30T16:50:00.000Z","ID":"CVE-2020-14523","STATE":"PUBLIC","TITLE":"Mitsubishi Electric Factory Automation Products Path Traversal"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"CW Configurator","version":{"version_data":[{"version_affected":"<=","version_value":"Version 1.010L"}]}},{"product_name":"FR Configurator2","version":{"version_data":[{"version_affected":"<=","version_value":"Version 1.22Y"}]}},{"product_name":"GX Works2","version":{"version_data":[{"version_affected":"<=","version_value":"Version 1.595V"}]}},{"product_name":"GX Works3","version":{"version_data":[{"version_affected":"<=","version_value":"Version 1.063R"}]}},{"product_name":"MELSOFT iQ AppPortal","version":{"version_data":[{"version_affected":"<=","version_value":"Version 1.17T"}]}},{"product_name":"MELSOFT Navigator","version":{"version_data":[{"version_affected":"<=","version_value":"Version2.70Y"}]}},{"product_name":"MI Configurator","version":{"version_data":[{"version_affected":"=","version_value":"All Versions"}]}},{"product_name":"MR Configurator2","version":{"version_data":[{"version_affected":"<=","version_value":"Version 1.110Q"}]}},{"product_name":"MT Works2","version":{"version_data":[{"version_affected":"<=","version_value":"Versions 1.156N"}]}},{"product_name":"MX Component","version":{"version_data":[{"version_affected":"<=","version_value":"Version 4.20W"}]}},{"product_name":"RT ToolBox3","version":{"version_data":[{"version_affected":"<=","version_value":"Versions 1.70Y"}]}},{"product_name":"MELSEC iQ-R Series Motion Module","version":{"version_data":[{"version_affected":"<=","version_value":"Versions 10"}]}}]},"vendor_name":"Mitsubishi Electric"}]}},"credit":[{"lang":"eng","value":"Mashav Sapir of Claroty reported this vulnerability to CISA"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}]},"references":{"reference_data":[{"name":"https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-03","refsource":"MISC","url":"https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-03"},{"name":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdf","refsource":"MISC","url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdf"},{"name":"https://jvn.jp/vu/JVNVU90224831/","refsource":"MISC","url":"https://jvn.jp/vu/JVNVU90224831/"}]},"solution":[{"lang":"en"}],"source":{"advisory":"ICSA-20-212-03","discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-03","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-008_en.pdf","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://jvn.jp/vu/JVNVU90224831/","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T12:46:34.640Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-04-16T17:31:26.782063Z","id":"CVE-2020-14523","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-04-16T18:01:22.616Z"}}]}}}