title: Mitsubishi Electric Factory Automation Products Path Traversal
description: Multiple Mitsubishi Electric Factory Automation products have a vulnerability that allows an attacker to execute arbitrary code.
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: CW Configurator
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Version 1.010L, status: affected, version: unspecified, versionType: custom
}
{
product: FR Configurator2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Version 1.22Y, status: affected, version: unspecified, versionType: custom
}
{
product: GX Works2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Version 1.595V, status: affected, version: unspecified, versionType: custom
}
{
product: GX Works3
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Version 1.063R, status: affected, version: unspecified, versionType: custom
}
{
product: MELSOFT iQ AppPortal
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Version 1.17T, status: affected, version: unspecified, versionType: custom
}
{
product: MELSOFT Navigator
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Version2.70Y, status: affected, version: unspecified, versionType: custom
}
{
product: MI Configurator
vendor: Mitsubishi Electric
versions:
status: affected, version: All Versions
}
{
product: MR Configurator2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Version 1.110Q, status: affected, version: unspecified, versionType: custom
}
{
product: MT Works2
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Versions 1.156N, status: affected, version: unspecified, versionType: custom
}
{
product: MX Component
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Version 4.20W, status: affected, version: unspecified, versionType: custom
}
{
product: RT ToolBox3
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Versions 1.70Y, status: affected, version: unspecified, versionType: custom
}
{
product: MELSEC iQ-R Series Motion Module
vendor: Mitsubishi Electric
versions:
lessThanOrEqual: Versions 10, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]