CVE-2019-10976

2019-07-2523:27:48

CWE-611

icscert

www.cve.org

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.1%

JSON

Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.

CNA Affected

[
  {
    "product": "Mitsubishi Electric FR Configurator2",
    "vendor": "Mitsubishi Electric",
    "versions": [
      {
        "status": "affected",
        "version": "Version 1.16S and prior"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsa-19-204-01