Mitsubishi Electric Factory Automation Engineering Products (Update L)

Risk Summary

Successful exploitation of this vulnerability could allow a remote attacker to disclose information, tamper with information, cause a denial-of-service (DoS) condition on the affected products, and so on by replacing certain files in the product which have improper permissions with crafted files.

CVEs (1)

Remediations

• Mitsubishi Electric is releasing fixed version 2.10 or later for C Controller Interface Module utility. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.01B or later for CC-Link IE Control Network Data Collector. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.01B or later for CC-Link IE Field Network Data Collector. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.01B or later for CC-Link IE TSN Data Collector. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.106K or later for CPU Module Logging Configuration Tool. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.011M or later for CW Configurator. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 3.43V or later for Data Transfer. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 5.2 or later for EZSocket. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.27D or later for FR Configurator2. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.245F or later for GT Designer3 Version1 (GOT1000). Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.245F or later for GT Designer3 Version1 (GOT2000). Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 3.245F or later for GT SoftGOT1000 Version3. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.245F or later for GT SoftGOT2000 Version1. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 8.505B or later for GX Developer. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.106K or later for GX LogViewer. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.605F or later for GX Works2. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.065T or later for GX Works3. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.04E or later for M_CommDTM-IO-Link. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 4.5 or later for MELFA-Works. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.07H or later for MELSOFT Complete Clean Up Tool. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.020W or later for MELSOFT EM Software Development Kit. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.20W or later for MELSOFT iQ AppPortal. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 2.78G or later for MELSOFT Navigator. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.005F or later for MI Configurator. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.006G or later for Motion Control Setting. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.010L or later for Motorizer. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.130L or later for MR Configurator2. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.170C or later for MT Works2. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.1.5.0 or later for MTConnect Data Collector. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 4.21X or later for MX Component. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.22Y or later for MX MESInterface. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.13P or later for MX MESInterface-R. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 2.16S or later for MX Sheet. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.30G or later for Network Interface Board CC IE Control Utility. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.17T or later for Network Interface Board CC IE Field Utility. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.24A or later for Network Interface Board CC-Link Ver.2 Utility. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 35M or later for Network Interface Board MNETH Utility. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 3.30 or later for Position Board utility 2. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.54G or later for PX Developer. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 3.74C or later for RT ToolBox2. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.90U or later for RT ToolBox3. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 3.14Q or later for Setting/monitoring tools for the C Controller module (SW3PVC-CCPU). Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 4.13P or later for Setting/monitoring tools for the C Controller module (SW4PVC-CCPU). Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.05F or later for SLMP Data Collector. Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.05F or later for Simple Motion Module (Positioning Control) FB Library (Japanese) and Simple Motion Module (Positioning Control) FB Library (Other languages). Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• Mitsubishi Electric is releasing fixed version 1.03D or later for Simple Motion Module (Synchronous Control) FB Library (Japanese) and Simple Motion Module (Synchronous Control) FB Library (Other languages). Please download the fixed version from the link "https://www.mitsubishielectric.com/fa/download/index.html" and install it. For more information on the fixed version, refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf".
• There are no plans to release a fixed version for FR Configurator SW3. Refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf", and take the actions described there.
• There are no plans to release a fixed version for GT Designer2 Classic. Refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf", and take the actions described there.
• There are no plans to release a fixed version for MELSEC WinCPU Setting Utility. Refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf", and take the actions described there.
• There are no plans to release a fixed version for QD72P3C3 FB Library (Japanese). Refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf", and take the actions described there.
• There are no plans to release a fixed version for QD62(E/D), LD62(D) FB Library (E/D). Refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf", and take the actions described there.
• There are no plans to release a fixed version for QD64D2 FB Library (Japanese). Refer to the Mitsubishi Electric security advisory at "https://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-007_en.pdf", and take the actions described there.
• For users of the affected products, Mitsubishi Electric recommends that, if a "File Name Warning" message appears when Windows starts, follow the instructions in the message, such as renaming the file, and take appropriate action before installing or operating the affected product, to minimize the risk of exploiting this vulnerability.
• For users of the affected products, Mitsubishi Electric recommends operating the products under an account that does not have administrator's privileges, to minimize the risk of exploiting this vulnerability.
• For users of the affected products, Mitsubishi Electric recommends installing an antivirus software in your personal computer using the products, to minimize the risk of exploiting this vulnerability.
• For users of the affected products, Mitsubishi Electric recommends restricting network exposure of all control system devices or systems to the minimum necessary and ensuring that they are not accessible from untrusted networks and hosts, to minimize the risk of exploiting this vulnerability.
• For users of the affected products, Mitsubishi Electric recommends locating control system networks and remote devices behind firewalls and isolating them from the business network, to minimize the risk of exploiting this vulnerability.
• For users of the affected products, Mitsubishi Electric recommends using a firewall, virtual private network (VPN), etc. to prevent unauthorized access when internet access is required, to minimize the risk of exploiting this vulnerability.

Affected Vendors

Affected Products (54)

Affected Sectors

Critical Manufacturing