CVE-2020-5602

🗓️ 30 Jun 2020 10:20:45Reported by jpcertType

Mitsubishi Electoric FA Engineering Software vulnerable to XXE attacks

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2020-5602	30 Jun 202010:20	–	cvelist
EUVD	EUVD-2020-26763	7 Oct 202500:30	–	euvd
ICS	Mitsubishi Electric Factory Automation Engineering Software Products	30 Jun 202000:00	–	ics
NVD	CVE-2020-5602	30 Jun 202011:15	–	nvd
Prion	Xxe	30 Jun 202011:15	–	prion
RedhatCVE	CVE-2020-5602	22 May 202517:42	–	redhatcve
Tenable Nessus	Mitsubishi (CVE-2020-5602) (deprecated)	7 Feb 202200:00	–	nessus

NVD

Node

mitsubishielectric cpu_module_logging_configuration_toolRange≤1.94y

mitsubishielectric cw_configuratorRange≤1.010l

mitsubishielectric em_configuratorRange≤1.010l

mitsubishielectric gt_designer3Range≤1.221f

mitsubishielectric gx_logviewerRange≤1.100e

mitsubishielectric gx_works2Range≤1.590q

mitsubishielectric gx_works3Range≤1.060n

mitsubishielectric m_commdtm-hartRange≤1.01b

mitsubishielectric m_commdtm-io-linkRange≤1.03d

mitsubishielectric melfa-worksRange≤4.4

mitsubishielectric melsec-l_flexible_high-speed_i/o_control_module_configuration_toolRange≤1.005f

mitsubishielectric melsoft_fielddeviceconfiguratorRange≤1.04e

mitsubishielectric melsoft_iq_appportalRange≤1.14q

mitsubishielectric melsoft_navigatorRange≤2.62q

mitsubishielectric mi_configuratorRange≤1.004e

mitsubishielectric motion_control_settingRange≤1.006g

mitsubishielectric mr_configurator2Range≤1.100e

mitsubishielectric mt_works2Range≤1.160s

mitsubishielectric rt_toolbox2Range≤3.73b

mitsubishielectric rt_toolbox3Range≤1.60n

[
  {
    "product": "Mitsubishi Electoric FA Engineering Software",
    "vendor": "Mitsubishi Electric Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit (EM Configurator) Ver. 1.010L and earlier, GT Designer3 (GOT2000) Ver. 1.221F and earlier, GX LogViewer Ver. 1.96A and earlier, GX Works2 Ver. 1.586L and earlier, GX Works3 Ver. 1.058L and earlier, M_CommDTM-HART Ver. 1.00A, M_CommDTM-IO-Link Ver. 1.02C and earlier, MELFA-Works Ver. 4.3 and earlier, MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool Ver.1.004E and earlier, MELSOFT FieldDeviceConfigurator Ver. 1.03D and earlier, MELSOFT iQ AppPortal Ver. 1.11M and earlier, MELSOFT Navigator Ver. 2.58L and earlier, MI Configurator Ver. 1.003D and earlier, Motion Control Setting Ver. 1.005F and earlier, MR Configurator2 Ver. 1.72A and earlier, MT Works2 Ver. 1.156N and earlier, RT ToolBox2 Ver. 3.72A and earlier, and RT ToolBox3 Ver. 1.50C and earlier"
      }
    ]
  }
]

Source	Link
mitsubishielectric	www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-004_en.pdf
jvn	www.jvn.jp/en/vu/JVNVU90307594/index.html

21 Nov 2024 05:34Current

7.2High risk

Vulners AI Score7.2

CVSS 25

CVSS 3.17.5

EPSS0.00408

CWE-611