CVE-2020-14496

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information to be disclosed, tampered with, and/or destroyed.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-275

Affected software

VendorProductVersions
Mitsubishi ElectricCPU Module Logging Configuration Tool>= All, <= 1.100E
Mitsubishi ElectricCW Configurator>= All, <= 1.010L
Mitsubishi ElectricData Transfer>= All, <= 3.40S
Mitsubishi ElectricEZSocket>= All, <= 4.5
Mitsubishi ElectricFR Configurator2>= All, <= 1.22Y
Mitsubishi ElectricGT Designer3 Version1 (GOT2000)>= All, <= 1.235V
Mitsubishi ElectricGT SoftGOT1000 Version3>= All, <= 3.200J
Mitsubishi ElectricGT SoftGOT1000 Version3All
Mitsubishi ElectricGT SoftGOT2000 Version1>= All, <= 1.235V
Mitsubishi ElectricGX LogViewer>= All, <= 1.100E
Mitsubishi ElectricGX Works2>= All, <= 1.592S
Mitsubishi ElectricGX Works3>= All, <= 1.063R
Mitsubishi ElectricM_CommDTM-HARTAll 1.00A
Mitsubishi ElectricM_CommDTM-IO-LinkAll
Mitsubishi ElectricMELFA-Works>= All, <= 4.3
Mitsubishi ElectricMELSEC WinCPU Setting UtilityAll
Mitsubishi ElectricMELSOFT EM Software Development Kit (EM Configurator)>= All, <= 1.010L
Mitsubishi ElectricMELSOFT FieldDeviceConfigurator>= All, <= 1.03D
Mitsubishi ElectricMELSOFT Navigator>= All, <= 2.62Q
Mitsubishi ElectricMH11 SettingTool Version2>= All, <= 2.002C
Mitsubishi ElectricMI ConfiguratorAll
Mitsubishi ElectricMotorizer>= All, <= 1.005F
Mitsubishi ElectricMR Configurator2>= All, <= 1.105K
Mitsubishi ElectricMT Works2>= All, <= 1.156N
Mitsubishi ElectricMX Component>= All, <= 4.19V
Mitsubishi ElectricNetwork Interface Board CC IE Control utilityAll
Mitsubishi ElectricNetwork Interface Board CC IE Field UtilityAll
Mitsubishi ElectricNetwork Interface Board CC-Link Ver.2 UtilityAll
Mitsubishi ElectricNetwork Interface Board MNETH utilityAll
Mitsubishi ElectricPX Developer>= All, <= 1.52E
Mitsubishi ElectricRT ToolBox2>= All, <= 3.72A
Mitsubishi ElectricRT ToolBox3>= All, <= 1.70Y
Mitsubishi ElectricSetting/monitoring tools for the C Controller moduleAll

References

Timeline

Published
May 19, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-144979.8Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-contrCVE-2020-1449810.0HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker CVE-2020-144997.5Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allCVE-2020-14505.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web requesCVE-2020-145009.8Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.CVE-2020-145019.8Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of thCVE-2020-145026.1The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicCVE-2020-145039.8Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability couldCVE-2020-145045.3The web interface of the 1734-AENTR communication module mishandles authentication for HTTP POST requests. A remote, unauthenticated attackeCVE-2020-145059.8Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerabCVE-2020-145064.3Philips Clinical Collaboration Platform, Versions 12.2.1 and prior. The product receives input or data, but it does not validate or incorrecCVE-2020-145079.8Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/dow
CVE-2020-14496: Critical severity, CVSS 9.8 | Vulnix