CVE record · CVE-2021-20587

Heap-based buffer overflow in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool and others

CVSS 7.5 HighEPSS 0.039 · 90th percentile

Published by the CVE Program (CNA: Mitsubishi) at 19 Feb 2021, 19:55 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Mitsubishi Electric Corporation	CPU Module Logging Configuration Tool	affected 1.112R and prior Other versions: unaffected
Mitsubishi Electric Corporation	CW Configurator	affected 1.011M and prior Other versions: unaffected
Mitsubishi Electric Corporation	Data Transfer	affected 3.44W and prior Other versions: unaffected
Mitsubishi Electric Corporation	EZSocket	affected 5.4 and prior Other versions: unaffected
Mitsubishi Electric Corporation	FR Configurator	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	FR Configurator SW3	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	FR Configurator2	affected 1.24A and prior Other versions: unaffected
Mitsubishi Electric Corporation	GT Designer3 Version1(GOT1000)	affected 1.250L and prior Other versions: unaffected
Mitsubishi Electric Corporation	GT Designer3 Version1(GOT2000)	affected 1.250L and prior Other versions: unaffected
Mitsubishi Electric Corporation	GT SoftGOT1000 Version3	affected 3.245F and prior Other versions: unaffected
Mitsubishi Electric Corporation	GT SoftGOT2000 Version1	affected 1.250L and prior Other versions: unaffected
Mitsubishi Electric Corporation	GX Configurator-DP	affected 7.14Q and prior Other versions: unaffected
Mitsubishi Electric Corporation	GX Configurator-QP	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GX Developer	affected 8.506C and prior Other versions: unaffected
Mitsubishi Electric Corporation	GX Explorer	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GX IEC Developer	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GX LogViewer	affected 1.115U and prior Other versions: unaffected
Mitsubishi Electric Corporation	GX RemoteService-I	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	GX Works2	affected 1.597X and prior Other versions: unaffected
Mitsubishi Electric Corporation	GX Works3	affected 1.070Y and prior Other versions: unaffected
Mitsubishi Electric Corporation	iQ Monozukuri ANDON (Data Transfer)	affected 1.003D and prior Other versions: unaffected
Mitsubishi Electric Corporation	iQ Monozukuri Process Remote Monitoring (Data Transfer)	affected 1.002C and prior Other versions: unaffected
Mitsubishi Electric Corporation	M_CommDTM-HART	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	M_CommDTM-IO-Link	affected 1.03D and prior Other versions: unaffected
Mitsubishi Electric Corporation	MELFA-Works	affected 4.4 and prior Other versions: unaffected
Mitsubishi Electric Corporation	MELSEC WinCPU Setting Utility	affected all versions Other versions: unaffected
Mitsubishi Electric Corporation	MELSOFT EM Software Development Kit (EM Configurator)	affected 1.015R and prior Other versions: unaffected
Mitsubishi Electric Corporation	MELSOFT Navigator	affected 2.74C and prior Other versions: unaffected
Mitsubishi Electric Corporation	MH11 SettingTool Version2	affected 2.004E and prior Other versions: unaffected
Mitsubishi Electric Corporation	MI Configurator	affected 1.004E and prior Other versions: unaffected
Mitsubishi Electric Corporation	MT Works2	affected 1.167Z and prior Other versions: unaffected
Mitsubishi Electric Corporation	MX Component	affected 5.001B and prior Other versions: unaffected
Mitsubishi Electric Corporation	Network Interface Board CC IE Control utility	affected 1.29F and prior Other versions: unaffected
Mitsubishi Electric Corporation	Network Interface Board CC IE Field Utility	affected 1.16S and prior Other versions: unaffected
Mitsubishi Electric Corporation	Network Interface Board CC-Link Ver.2 Utility	affected 1.23Z and prior Other versions: unaffected
Mitsubishi Electric Corporation	Network Interface Board MNETH utility	affected 34L and prior Other versions: unaffected
Mitsubishi Electric Corporation	PX Developer	affected 1.53F and prior Other versions: unaffected
Mitsubishi Electric Corporation	RT ToolBox2	affected 3.73B and prior Other versions: unaffected
Mitsubishi Electric Corporation	RT ToolBox3	affected 1.82L and prior Other versions: unaffected
Mitsubishi Electric Corporation	Setting/monitoring tools for the C Controller module (SW4PVC-CCPU)	affected 4.12N and prior Other versions: unaffected

And 1 more products. The full list is on the CVE record.

Identifiers: CVE-2021-20587
CNA: Mitsubishi
Weakness (CWE): CWE-122
Tags: Mitsubishi Electric Corporation CPU Module Logging Configuration Tool
Mitsubishi Electric Corporation CW Configurator
Mitsubishi Electric Corporation Data Transfer
Mitsubishi Electric Corporation EZSocket
Mitsubishi Electric Corporation FR Configurator
Mitsubishi Electric Corporation FR Configurator SW3
Mitsubishi Electric Corporation FR Configurator2
Mitsubishi Electric Corporation GT Designer3 Version1(GOT1000)
Memory corruption
Published: 19 Feb 2021
Updated: 12 Jun 2025

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.5	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CNA (Mitsubishi)

CISA KEV Not listed.
EPSS 0.039, the 90th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 19 Feb 2021. New records show when each source confirmed them.

Sources

References from the CNA

www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-021_en.pdf vendor-advisory
jvn.jp/vu/JVNVU92330101 government-resource
www.cisa.gov/news-events/ics-advisories/icsa-21-049-02 government-resource

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.