CVE record · CVE-2020-14496

Mitsubishi Electric Multiple Factory Automation Engineering Software Products (Update A) - Permission Issues

CVSS 8.3 HighEPSS 0.0087 · 58th percentile

Published by the CVE Program (CNA: icscert) at 19 May 2022, 17:24 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Mitsubishi Electric	CPU Module Logging Configuration Tool	affected All to 1.100E, inclusive custom
Mitsubishi Electric	CW Configurator	affected All to 1.010L, inclusive custom
Mitsubishi Electric	Data Transfer	affected All to 3.40S, inclusive custom
Mitsubishi Electric	EZSocket	affected All to 4.5, inclusive custom
Mitsubishi Electric	FR Configurator2	affected All to 1.22Y, inclusive custom
Mitsubishi Electric	GT Designer3 Version1 (GOT2000)	affected All to 1.235V, inclusive custom
Mitsubishi Electric	GT SoftGOT1000 Version3	affected All to 3.200J, inclusive custom
Mitsubishi Electric	GT SoftGOT1000 Version3	affected All
Mitsubishi Electric	GT SoftGOT2000 Version1	affected All to 1.235V, inclusive custom
Mitsubishi Electric	GX LogViewer	affected All to 1.100E, inclusive custom
Mitsubishi Electric	GX Works2	affected All to 1.592S, inclusive custom
Mitsubishi Electric	GX Works3	affected All to 1.063R, inclusive custom
Mitsubishi Electric	M_CommDTM-HART	affected All 1.00A
Mitsubishi Electric	M_CommDTM-IO-Link	affected All
Mitsubishi Electric	MELFA-Works	affected All to 4.3, inclusive custom
Mitsubishi Electric	MELSEC WinCPU Setting Utility	affected All
Mitsubishi Electric	MELSOFT EM Software Development Kit (EM Configurator)	affected All to 1.010L, inclusive custom
Mitsubishi Electric	MELSOFT FieldDeviceConfigurator	affected All to 1.03D, inclusive custom
Mitsubishi Electric	MELSOFT Navigator	affected All to 2.62Q, inclusive custom
Mitsubishi Electric	MH11 SettingTool Version2	affected All to 2.002C, inclusive custom
Mitsubishi Electric	MI Configurator	affected All
Mitsubishi Electric	Motorizer	affected All to 1.005F, inclusive custom
Mitsubishi Electric	MR Configurator2	affected All to 1.105K, inclusive custom
Mitsubishi Electric	MT Works2	affected All to 1.156N, inclusive custom
Mitsubishi Electric	MX Component	affected All to 4.19V, inclusive custom
Mitsubishi Electric	Network Interface Board CC IE Control utility	affected All
Mitsubishi Electric	Network Interface Board CC IE Field Utility	affected All
Mitsubishi Electric	Network Interface Board CC-Link Ver.2 Utility	affected All
Mitsubishi Electric	Network Interface Board MNETH utility	affected All
Mitsubishi Electric	PX Developer	affected All to 1.52E, inclusive custom
Mitsubishi Electric	RT ToolBox2	affected All to 3.72A, inclusive custom
Mitsubishi Electric	RT ToolBox3	affected All to 1.70Y, inclusive custom
Mitsubishi Electric	Setting/monitoring tools for the C Controller module	affected All

Identifiers: CVE-2020-14496
CNA: icscert
Weakness (CWE): CWE-275
Tags: Mitsubishi Electric CPU Module Logging Configuration Tool
Mitsubishi Electric CW Configurator
Mitsubishi Electric Data Transfer
Mitsubishi Electric EZSocket
Mitsubishi Electric FR Configurator2
Mitsubishi Electric GT Designer3 Version1 (GOT2000)
Mitsubishi Electric GT SoftGOT1000 Version3
Mitsubishi Electric GT SoftGOT2000 Version1
CWE-275
Published: 19 May 2022
Updated: 16 Apr 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.3	High	3.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	CNA (icscert)

CISA KEV Not listed.
EPSS 0.0087, the 58th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 19 May 2022. New records show when each source confirmed them.

Sources

References from the CNA

www.cisa.gov/uscert/ics/advisories/icsa-20-212-02

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.