CVE record · CVE-2020-14521

Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element

CVSS 8.3 HighEPSS 0.013 · 70th percentile

Published by the CVE Program (CNA: icscert) at 11 Feb 2022, 17:40 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Mitsubishi Electric	C Controller Interface Module Utility	affected unspecified to Version 2.00, inclusive custom Other versions: unaffected
Mitsubishi Electric	CC-Link IE Control Network Data Collector	affected Version 1.00A Other versions: unaffected
Mitsubishi Electric	CC-Link IE Field Network Data Collector	affected Version 1.00A Other versions: unaffected
Mitsubishi Electric	CC-Link IE TSN Data Collector	affected Version 1.00A Other versions: unaffected
Mitsubishi Electric	CPU Module Logging Configuration Tool	affected unspecified to Version 1.100E, inclusive custom Other versions: unaffected
Mitsubishi Electric	CW Configurator	affected unspecified to Version 1.010L, inclusive custom Other versions: unaffected
Mitsubishi Electric	Data Transfer	affected unspecified to Version 3.42U, inclusive custom Other versions: unaffected
Mitsubishi Electric	EZSocket	affected unspecified to Version 5.1, inclusive custom Other versions: unaffected
Mitsubishi Electric	FR Configurator SW3	affected All Versions Other versions: unaffected
Mitsubishi Electric	FR Configurator2	affected unspecified to Version 1.26C, inclusive custom Other versions: unaffected
Mitsubishi Electric	GT Designer2 Classic	affected All Versions Other versions: unaffected
Mitsubishi Electric	GT Designer3 Version1 (GOT1000)	affected unspecified to Version 1.241B, inclusive custom Other versions: unaffected
Mitsubishi Electric	GT Designer3 Version1 (GOT2000)	affected unspecified to Version 1.241B, inclusive custom Other versions: unaffected
Mitsubishi Electric	GT SoftGOT1000 Version3	affected unspecified to Version 3.200J, inclusive custom Other versions: unaffected
Mitsubishi Electric	GT SoftGOT2000 Version1	affected unspecified to Version 1.241B, inclusive custom Other versions: unaffected
Mitsubishi Electric	GX Developer	affected unspecified to Version 8.504A, inclusive custom Other versions: unaffected
Mitsubishi Electric	GX LogViewer	affected unspecified to Version 1.100E, inclusive custom Other versions: unaffected
Mitsubishi Electric	GX Works2	affected unspecified to Version 1.601B, inclusive custom Other versions: unaffected
Mitsubishi Electric	GX Works3	affected unspecified to Version 1.063R, inclusive custom Other versions: unaffected
Mitsubishi Electric	M_CommDTM-IO-Link	affected unspecified to Version 1.03D, inclusive custom Other versions: unaffected
Mitsubishi Electric	MELFA-Works	affected unspecified to Version 4.4, inclusive custom Other versions: unaffected
Mitsubishi Electric	MELSEC WinCPU Setting Utility	affected All Versions Other versions: unaffected
Mitsubishi Electric	MELSOFT Complete Clean Up Tool	affected unspecified to Version 1.06G, inclusive custom Other versions: unaffected
Mitsubishi Electric	MELSOFT EM Software Development Kit	affected unspecified to Version 1.015R, inclusive custom Other versions: unaffected
Mitsubishi Electric	MELSOFT iQ AppPortal	affected unspecified to Version 1.17T, inclusive custom Other versions: unaffected
Mitsubishi Electric	MELSOFT Navigator	affected unspecified to Version 2.74C, inclusive custom Other versions: unaffected
Mitsubishi Electric	MI Configurator	affected unspecified to Version 1.004E, inclusive custom Other versions: unaffected
Mitsubishi Electric	Motion Control Setting	affected unspecified to Version 1.005F, inclusive custom Other versions: unaffected
Mitsubishi Electric	Motorizer	affected unspecified to Version 1.005F, inclusive custom Other versions: unaffected
Mitsubishi Electric	MR Configurator2	affected unspecified to Version 1.125F, inclusive custom Other versions: unaffected
Mitsubishi Electric	MT Works2	affected unspecified to Version 1.167Z, inclusive custom Other versions: unaffected
Mitsubishi Electric	MTConnect Data Collector	affected unspecified to Version 1.1.4.0, inclusive custom Other versions: unaffected
Mitsubishi Electric	MX Component	affected unspecified to Version 4.20W, inclusive custom Other versions: unaffected
Mitsubishi Electric	MX MESInterface	affected unspecified to Version 1.21X, inclusive custom Other versions: unaffected
Mitsubishi Electric	MX MESInterface-R	affected unspecified to Version 1.12N, inclusive custom Other versions: unaffected
Mitsubishi Electric	MX Sheet	affected unspecified to Version 2.15R, inclusive custom Other versions: unaffected
Mitsubishi Electric	Network Interface Board CC IE Control Utility	affected unspecified to Version 1.29F, inclusive custom Other versions: unaffected
Mitsubishi Electric	Network Interface Board CC IE Field Utility	affected unspecified to Versions 1.16S, inclusive custom Other versions: unaffected
Mitsubishi Electric	Network Interface Board CC-Link Ver.2 Utility	affected unspecified to Version 1.23Z, inclusive custom Other versions: unaffected
Mitsubishi Electric	Network Interface Board MNETH Utility	affected unspecified to Version 34L, inclusive custom Other versions: unaffected

And 6 more products. The full list is on the CVE record.

Identifiers: CVE-2020-14521
CNA: icscert
Weakness (CWE): CWE-428
Tags: Mitsubishi Electric C Controller Interface Module Utility
Mitsubishi Electric CC-Link IE Control Network Data Collector
Mitsubishi Electric CC-Link IE Field Network Data Collector
Mitsubishi Electric CC-Link IE TSN Data Collector
Mitsubishi Electric CPU Module Logging Configuration Tool
Mitsubishi Electric CW Configurator
Mitsubishi Electric Data Transfer
Mitsubishi Electric EZSocket
CWE-428
Published: 11 Feb 2022
Updated: 16 Apr 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
8.3	High	3.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H	CNA (icscert)

CISA KEV Not listed.
EPSS 0.013, the 70th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 11 Feb 2022. New records show when each source confirmed them.

Sources

References from the CNA

www.cisa.gov/uscert/ics/advisories/icsa-20-212-04 government-resource
www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf vendor-advisory

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.