CVE-2020-14521 Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element
Attackers can execute malicious code via unquoted search paths in Mitsubishi factory automation tools, leading to privilege escalation and system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-14521?
CVE-2020-14521 is a high-severity vulnerability in Mitsubishi Electric C Controller Interface Module Utility, published on 11 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.
Which versions are affected by CVE-2020-14521?
It affects 46 products.
Products include Mitsubishielectric C Controller Interface Module Utility, Mitsubishielectric C Controller Module Setting and Monitoring Tool, Mitsubishielectric Cc-Link Ie Control Network Data Collector, Mitsubishielectric Cc-Link Ie Field Network Data Collector, Mitsubishielectric Cc-Link Ie Tsn Data Collector, Mitsubishielectric Cpu Module Logging Configuration Tool and 40 more.
How do I fix CVE-2020-14521?
No fix has been published for CVE-2020-14521 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-14521 being exploited?
There is no known exploitation of CVE-2020-14521 in the wild and no public exploit code.
Sources
Also known as GHSA-7hfr-xh2r-6vj8.