Mitsubishi Electric FA Engineering Software (Update A)

Risk Summary

Successful exploitation of this vulnerability could allow a local attacker to execute code, which could result in information disclosure, tampering with and deletion of information, or a denial-of-service (DoS) condition.

CVEs (1)

Remediations

• Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting this vulnerability:
• Install the affected products in their default installation locations. If users install CPU Module Logging Configuration Tool, EZSocket, FR Configurator2, GT Designer3 Version1(GOT2000), GT SoftGOT1000 Version3, GT SoftGOT2000 Version1, GX LogViewer, GX Works2, GX Works3, MELSOFT FieldDeviceConfigurator, MELSOFT Navigator, MX Component, RT ToolBox3 or Data Transfer, install the following versions or later, because products with versions prior to the following are vulnerable to CVE-2020-14496 and the mitigation measures are not effective. CPU Module Logging Configuration Tool: Ver 1.106K and later, EZSocket: Ver 4.6 and later, FR Configurator2: Ver 1.23Z and later, GT Designer3 Version1(GOT2000): Ver 1.236W and later, GT SoftGOT1000 Version3: Ver 3.245F and later, GT SoftGOT2000 Version1: Ver 1.236W and later, GX LogViewer: Ver 1.106K and later, GX Works2: Ver 1.595V and later, GX Works3: Ver 1.065T and later, MELSOFT FieldDeviceConfigurator: Ver 1.04E and later, MELSOFT Navigator: Ver 2.70Y and later, MX Component: Ver 4.20W and later, RT ToolBox3: Ver 1.80J and later, Data Transfer: Ver 3.41T and later
• If it is necessary to change the installation folder from the default, select a folder that only users with Administrator privileges have permission to change.
• Install an anti-virus software on the computer using the affected product.
• Use your computer with the affected product within the LAN and block remote login from untrusted networks, hosts, and users.
• When connecting your computer with the affected product to the Internet, use a firewall, virtual private network (VPN),etc., and allow only trusted users to remote login.
• Don't open untrusted files or click untrusted links.
• For more information, see the Mitsubishi Electric security advisory.

Affected Vendors

Affected Products (26)

Affected Sectors

Critical Manufacturing