QID 590711

QID 590711: Mitsubishi Electric Factory Automation Engineering Software Products Multiple Vulnerabilities (ICSA-20-182-02)

AFFECTED PRODUCTS
The following versions of Factory Automation engineering software products are affected:
CPU Module Logging Configuration Tool, Versions 1.94Y and prior
CW Configurator, Versions 1.010L and prior
EM Software Development Kit (EM Configurator), Versions 1.010L and prior
GT Designer3GOT2000), Versions 1.221F and prior
GX LogViewer, Versions 1.96A and prior
GX Works2, Versions 1.586L and prior
GX Works3, Versions 1.058L and prior
M_CommDTM-HART, Version 1.00A
M_CommDTM-IO-Link, Versions 1.02C and prior
MELFA-Works, Versions 4.3 and prior
MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool, Versions 1.004E and prior
MELSOFT FieldDeviceConfigurator, Versions 1.03D and prior
MELSOFT iQ AppPortal, Versions 1.11M and prior
MELSOFT Navigator, Versions 2.58L and prior
MI Configurator, Versions 1.003D and prior
Motion Control Setting, Versions 1.005F and prior
MR Configurator2, Versions 1.72A and prior
MT Works2, Versions 1.156N and prior
RT ToolBox2, Versions 3.72A and prior
RT ToolBox3, Versions 1.50C and prior

QID Detection Logic (Authenticated):
QID checks for the Vulnerable version of using passive scanning

Successful exploitation of these vulnerabilities could allow a local attacker to send files outside of the system as well as cause a denial-of-service condition.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to CERT MITIGATIONS section ICSA-20-182-02 for affected packages and patching details.

Vendor References

ICSA-20-182-02 - www.us-cert.gov/ics/advisories/ICSA-20-182-02

CVEs related to QID 590711

CVE-2020-5603 | CVE-2020-5602 |

Software Advisories

Advisory ID	Software	Component	Link
ICSA-20-182-02			www.us-cert.gov/ics/advisories/ICSA-20-182-02

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].