CVE-2020-14521

Q: What is the severity of CVE-2020-14521?

CVE-2020-14521 has a CVSS score of 8.3 (HIGH). This vulnerability in Mitsubishi Electric Factory Automation engineering software allows malicious code execution, enabling attackers to steal data, modify systems, or cause denial-of-service. It affects multiple industrial control system (ICS) engineering tools used for programming and configuring factory equipment. Organizations using these products in industrial environments are at risk.

8.3 HIGH

Remote Code Execution

📋 TL;DR

This vulnerability in Mitsubishi Electric Factory Automation engineering software allows malicious code execution, enabling attackers to steal data, modify systems, or cause denial-of-service. It affects multiple industrial control system (ICS) engineering tools used for programming and configuring factory equipment. Organizations using these products in industrial environments are at risk.

💻 Affected Systems

Products:

MELSOFT series engineering software products including GX Works3, GX Works2, MT Works2, MX Component

Versions: Multiple versions as specified in vendor advisory

Operating Systems: Windows

Default Config Vulnerable: ⚠️ Yes

Notes: Affects engineering workstations used for programming PLCs and other industrial devices. Requires the software to be installed and running.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of industrial control systems leading to production shutdown, equipment damage, data theft, and safety incidents.

🟠

Likely Case

Unauthorized access to engineering workstations, data exfiltration, and disruption of programming/configuration capabilities.

🟢

If Mitigated

Limited impact if systems are properly segmented, monitored, and access-controlled.

🌐 Internet-Facing: LOW - These engineering tools are typically deployed on internal networks, not directly internet-facing.

🏢 Internal Only: HIGH - Attackers with internal access or who breach the network can exploit this to compromise critical industrial systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires access to the engineering workstation and knowledge of the software. No public exploit code is available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions specified in Mitsubishi Electric advisory 2020-007

Vendor Advisory: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf

Restart Required: Yes

Instructions:

1. Download updated software versions from Mitsubishi Electric support portal. 2. Install updates on all affected engineering workstations. 3. Restart systems after installation. 4. Verify installation through version checks.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate engineering workstations from general corporate networks and internet access

Access Control

windows

Implement strict user access controls and principle of least privilege for engineering software

🧯 If You Can't Patch

Implement strict network segmentation to isolate engineering workstations
Apply host-based firewalls and disable unnecessary services on affected systems

🔍 How to Verify

Check if Vulnerable:

Check installed version of MELSOFT software against vulnerable versions listed in vendor advisory

Check Version:

Check version through software's Help > About menu or Windows Programs and Features

Verify Fix Applied:

Verify software version matches patched versions in advisory and test functionality

📡 Detection & Monitoring

Log Indicators:

Unusual process execution from engineering software
Unexpected network connections from engineering workstations
Failed authentication attempts to engineering software

Network Indicators:

Unexpected traffic from engineering workstations to external networks
Anomalous protocol usage on engineering network segments

SIEM Query:

source="engineering-workstation" AND (event_type="process_creation" OR event_type="network_connection") AND severity>=medium

📊 Metadata

CVE ID: CVE-2020-14521

CVSS v3 Score: 8.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE: CWE-428

Published: February 11, 2022

Last Updated: November 21, 2024

🔗 References

https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-04 Third Party Advisory,US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf Vendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-20-212-04 Third Party Advisory,US Government Resource
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-007_en.pdf Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

C Controller Interface Module Utility by Mitsubishielectric

C Controller Module Setting And Monitoring Tool by Mitsubishielectric

Cc Link Ie Control Network Data Collector by Mitsubishielectric

Cc Link Ie Field Network Data Collector by Mitsubishielectric

Cc Link Ie Tsn Data Collector by Mitsubishielectric

Cpu Module Logging Configuration Tool by Mitsubishielectric

Cw Configurator by Mitsubishielectric

Data Transfer by Mitsubishielectric

Ezsocket by Mitsubishielectric

Fr Configurator Sw3 by Mitsubishielectric

Fr Configurator2 by Mitsubishielectric

Gt Designer2 Classic by Mitsubishielectric

Gt Designer3 by Mitsubishielectric

Gt Softgot1000 by Mitsubishielectric

Gt Softgot2000 by Mitsubishielectric

Gx Developer by Mitsubishielectric

Gx Logviewer by Mitsubishielectric

Gx Works2 by Mitsubishielectric

Gx Works3 by Mitsubishielectric

M Commdtm Io Link by Mitsubishielectric

Melfa Works by Mitsubishielectric

Melsec Wincpu Setting Utility by Mitsubishielectric

Melsoft Complete Clean Up Tool by Mitsubishielectric

Melsoft Em Software Development Kit by Mitsubishielectric

Melsoft Iq Appportal by Mitsubishielectric

Melsoft Navigator by Mitsubishielectric

Mi Configurator by Mitsubishielectric

Motion Control Setting by Mitsubishielectric

Motorizer by Mitsubishielectric

Mr Configurator2 by Mitsubishielectric

Mt Works2 by Mitsubishielectric

Mtconnect Data Collector by Mitsubishielectric

Mx Component by Mitsubishielectric

Mx Mesinterface by Mitsubishielectric

Mx Mesinterface R by Mitsubishielectric

Mx Sheet by Mitsubishielectric

Network Interface Board Cc Ie Control Utility Firmware by Mitsubishielectric

Network Interface Board Cc Ie Field Utility Firmware by Mitsubishielectric

Network Interface Board Cc Link Ver.2 Utility Firmware by Mitsubishielectric

Network Interface Board Mneth Utility Firmware by Mitsubishielectric

Position Board Utility 2 by Mitsubishielectric

Px Developer by Mitsubishielectric

Rt Toolbox2 by Mitsubishielectric

Rt Toolbox3 by Mitsubishielectric

Setting\/monitoring Tools For The C Controller Module by Mitsubishielectric

Slmp Data Collector by Mitsubishielectric