CVE-2020-14521

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428CWE-276

Affected software

VendorProductVersions
Mitsubishi ElectricC Controller Interface Module Utility>= unspecified, <= Version 2.00
Mitsubishi ElectricCC-Link IE Control Network Data CollectorVersion 1.00A
Mitsubishi ElectricCC-Link IE Field Network Data CollectorVersion 1.00A
Mitsubishi ElectricCC-Link IE TSN Data CollectorVersion 1.00A
Mitsubishi ElectricCPU Module Logging Configuration Tool>= unspecified, <= Version 1.100E
Mitsubishi ElectricCW Configurator>= unspecified, <= Version 1.010L
Mitsubishi ElectricData Transfer>= unspecified, <= Version 3.42U
Mitsubishi ElectricEZSocket>= unspecified, <= Version 5.1
Mitsubishi ElectricFR Configurator SW3All Versions
Mitsubishi ElectricFR Configurator2>= unspecified, <= Version 1.26C
Mitsubishi ElectricGT Designer2 ClassicAll Versions
Mitsubishi ElectricGT Designer3 Version1 (GOT1000)>= unspecified, <= Version 1.241B
Mitsubishi ElectricGT Designer3 Version1 (GOT2000)>= unspecified, <= Version 1.241B
Mitsubishi ElectricGT SoftGOT1000 Version3>= unspecified, <= Version 3.200J
Mitsubishi ElectricGT SoftGOT2000 Version1>= unspecified, <= Version 1.241B
Mitsubishi ElectricGX Developer>= unspecified, <= Version 8.504A
Mitsubishi ElectricGX LogViewer>= unspecified, <= Version 1.100E
Mitsubishi ElectricGX Works2>= unspecified, <= Version 1.601B
Mitsubishi ElectricGX Works3>= unspecified, <= Version 1.063R
Mitsubishi ElectricM_CommDTM-IO-Link>= unspecified, <= Version 1.03D
Mitsubishi ElectricMELFA-Works>= unspecified, <= Version 4.4
Mitsubishi ElectricMELSEC WinCPU Setting UtilityAll Versions
Mitsubishi ElectricMELSOFT Complete Clean Up Tool>= unspecified, <= Version 1.06G
Mitsubishi ElectricMELSOFT EM Software Development Kit>= unspecified, <= Version 1.015R
Mitsubishi ElectricMELSOFT iQ AppPortal>= unspecified, <= Version 1.17T
Mitsubishi ElectricMELSOFT Navigator>= unspecified, <= Version 2.74C
Mitsubishi ElectricMI Configurator>= unspecified, <= Version 1.004E
Mitsubishi ElectricMotion Control Setting>= unspecified, <= Version 1.005F
Mitsubishi ElectricMotorizer>= unspecified, <= Version 1.005F
Mitsubishi ElectricMR Configurator2>= unspecified, <= Version 1.125F
Mitsubishi ElectricMT Works2>= unspecified, <= Version 1.167Z
Mitsubishi ElectricMTConnect Data Collector>= unspecified, <= Version 1.1.4.0
Mitsubishi ElectricMX Component>= unspecified, <= Version 4.20W
Mitsubishi ElectricMX MESInterface>= unspecified, <= Version 1.21X
Mitsubishi ElectricMX MESInterface-R>= unspecified, <= Version 1.12N
Mitsubishi ElectricMX Sheet>= unspecified, <= Version 2.15R
Mitsubishi ElectricNetwork Interface Board CC IE Control Utility>= unspecified, <= Version 1.29F
Mitsubishi ElectricNetwork Interface Board CC IE Field Utility>= unspecified, <= Versions 1.16S
Mitsubishi ElectricNetwork Interface Board CC-Link Ver.2 Utility>= unspecified, <= Version 1.23Z
Mitsubishi ElectricNetwork Interface Board MNETH Utility>= unspecified, <= Version 34L
Mitsubishi ElectricPosition Board utility 2>= unspecified, <= Version 3.20
Mitsubishi ElectricPX Developer>= unspecified, <= Version 1.53F
Mitsubishi ElectricRT ToolBox2>= unspecified, <= Version 3.73B
Mitsubishi ElectricRT ToolBox3>= unspecified, <= Version 1.82L
Mitsubishi ElectricSetting/Monitoring tools for the C Controller module>= unspecified, <= SW3PVC-CCPU Version 3.13P; >= unspecified, <= SW4PVC-CCPU Version 4.12N
Mitsubishi ElectricSLMP Data Collector>= unspecified, <= Version 1.04E

References

Timeline

Published
Feb 11, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-145227.5Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to uncontrolled rCVE-2020-145239.8Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.CVE-2020-145249.8Softing Industrial Automation all versions prior to the latest build of version 4.47.0, The affected product is vulnerable to a heap-based bCVE-2020-145253.5Philips Clinical Collaboration Platform, Versions 12.2.1 and prior, does not neutralize or incorrectly neutralizes user-controllable input CVE-2020-145275.9Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versioCVE-2020-145286.1Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versioCVE-2020-145295.4Vulnerability in the Primavera Portfolio Management product of Oracle Construction and Engineering (component: Investor Module). Supported vCVE-2020-14538.6<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an applicationCVE-2020-145305.9Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: None). The supported version that is affected iCVE-2020-145315.9Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: SWSE Server). Supported versions that are affected are 20.CVE-2020-145324.7Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that CVE-2020-145333.5Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). Supported versions that
CVE-2020-14521: Critical severity, CVSS 9.8 | Vulnix