title: Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues
description: Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to escalate privilege and execute malicious programs, which could cause a denial-of-service condition, and allow information to be disclosed, tampered with, and/or destroyed.
problem types: CWE-275 Permission Issues
affected:
{
product: CPU Module Logging Configuration Tool
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.100E, status: affected, version: All, versionType: custom
}
{
product: CW Configurator
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.010L, status: affected, version: All, versionType: custom
}
{
product: Data Transfer
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 3.40S, status: affected, version: All, versionType: custom
}
{
product: EZSocket
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 4.5, status: affected, version: All, versionType: custom
}
{
product: FR Configurator2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.22Y, status: affected, version: All, versionType: custom
}
{
product: GT Designer3 Version1 (GOT2000)
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.235V, status: affected, version: All, versionType: custom
}
{
product: GT SoftGOT1000 Version3
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 3.200J, status: affected, version: All, versionType: custom
}
{
product: GT SoftGOT1000 Version3
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
{
product: GT SoftGOT2000 Version1
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.235V, status: affected, version: All, versionType: custom
}
{
product: GX LogViewer
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.100E, status: affected, version: All, versionType: custom
}
{
product: GX Works2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.592S, status: affected, version: All, versionType: custom
}
{
product: GX Works3
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.063R, status: affected, version: All, versionType: custom
}
{
product: M_CommDTM-HART
vendor: Mitsubishi Electric
versions:
status: affected, version: All 1.00A
}
{
product: M_CommDTM-IO-Link
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
{
product: MELFA-Works
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 4.3, status: affected, version: All, versionType: custom
}
{
product: MELSEC WinCPU Setting Utility
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
{
product: MELSOFT EM Software Development Kit (EM Configurator)
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.010L, status: affected, version: All, versionType: custom
}
{
product: MELSOFT FieldDeviceConfigurator
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.03D, status: affected, version: All, versionType: custom
}
{
product: MELSOFT Navigator
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 2.62Q, status: affected, version: All, versionType: custom
}
{
product: MH11 SettingTool Version2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 2.002C, status: affected, version: All, versionType: custom
}
{
product: MI Configurator
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
{
product: Motorizer
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.005F, status: affected, version: All, versionType: custom
}
{
product: MR Configurator2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.105K, status: affected, version: All, versionType: custom
}
{
product: MT Works2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.156N, status: affected, version: All, versionType: custom
}
{
product: MX Component
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 4.19V, status: affected, version: All, versionType: custom
}
{
product: Network Interface Board CC IE Control utility
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
{
product: Network Interface Board CC IE Field Utility
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
{
product: Network Interface Board CC-Link Ver.2 Utility
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
{
product: Network Interface Board MNETH utility
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
{
product: PX Developer
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.52E, status: affected, version: All, versionType: custom
}
{
product: RT ToolBox2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 3.72A, status: affected, version: All, versionType: custom
}
{
product: RT ToolBox3
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: 1.70Y, status: affected, version: All, versionType: custom
}
{
product: Setting/monitoring tools for the C Controller module
vendor: Mitsubishi Electric
versions:
status: affected, version: All
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]