01 Record

CVE-2021-20587

Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions 1.011M and prior,

HighPUBLISHEDCNA: Mitsubishi

CNA base score7.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions 1.011M and prior,

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 3.88% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 89.8% of scored records. A rank, not a probability.
NVD base score: 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2021-02-19 19:55Z5 YR AGO

Last updated

2025-06-12 23:11Z1 YR AGO

Reserved

2020-12-17

Assigning CNA

Mitsubishi

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-122Heap-based Buffer OverflowVariant
CWE-787Out-of-bounds WriteBase

Data version

5.1

Document digest

62c15c17dd0b4aaaaa86e5fa12df6119402ac69d8fb61e1f6091bcbcdae40260

05 Affected products

VendorProductVersionsPlatforms

Mitsubishi Electric CorporationCPU Module Logging Configuration Tool1.112R and prior—

Mitsubishi Electric CorporationCW Configurator1.011M and prior—

Mitsubishi Electric CorporationData Transfer3.44W and prior—

Mitsubishi Electric CorporationEZSocket5.4 and prior—

Mitsubishi Electric CorporationFR Configuratorall versions—

Mitsubishi Electric CorporationFR Configurator SW3all versions—

Mitsubishi Electric CorporationFR Configurator21.24A and prior—

Mitsubishi Electric CorporationGT Designer3 Version1(GOT1000)1.250L and prior—

Mitsubishi Electric CorporationGT Designer3 Version1(GOT2000)1.250L and prior—

Mitsubishi Electric CorporationGT SoftGOT1000 Version33.245F and prior—

Mitsubishi Electric CorporationGT SoftGOT2000 Version11.250L and prior—

Mitsubishi Electric CorporationGX Configurator-DP7.14Q and prior—

Mitsubishi Electric CorporationGX Configurator-QPall versions—

Mitsubishi Electric CorporationGX Developer8.506C and prior—

Mitsubishi Electric CorporationGX Explorerall versions—

Mitsubishi Electric CorporationGX IEC Developerall versions—

Mitsubishi Electric CorporationGX LogViewer1.115U and prior—

Mitsubishi Electric CorporationGX RemoteService-Iall versions—

Mitsubishi Electric CorporationGX Works21.597X and prior—

Mitsubishi Electric CorporationGX Works31.070Y and prior—

Mitsubishi Electric CorporationiQ Monozukuri ANDON (Data Transfer)1.003D and prior—

Mitsubishi Electric CorporationiQ Monozukuri Process Remote Monitoring (Data Transfer)1.002C and prior—

Mitsubishi Electric CorporationM_CommDTM-HARTall versions—

Mitsubishi Electric CorporationM_CommDTM-IO-Link1.03D and prior—

Mitsubishi Electric CorporationMELFA-Works4.4 and prior—

Mitsubishi Electric CorporationMELSEC WinCPU Setting Utilityall versions—

Mitsubishi Electric CorporationMELSOFT EM Software Development Kit (EM Configurator)1.015R and prior—

Mitsubishi Electric CorporationMELSOFT Navigator2.74C and prior—

Mitsubishi Electric CorporationMH11 SettingTool Version22.004E and prior—

Mitsubishi Electric CorporationMI Configurator1.004E and prior—

Mitsubishi Electric CorporationMT Works21.167Z and prior—

Mitsubishi Electric CorporationMX Component5.001B and prior—

Mitsubishi Electric CorporationNetwork Interface Board CC IE Control utility1.29F and prior—

Mitsubishi Electric CorporationNetwork Interface Board CC IE Field Utility1.16S and prior—

Mitsubishi Electric CorporationNetwork Interface Board CC-Link Ver.2 Utility1.23Z and prior—

Mitsubishi Electric CorporationNetwork Interface Board MNETH utility34L and prior—

Mitsubishi Electric CorporationPX Developer1.53F and prior—

Mitsubishi Electric CorporationRT ToolBox23.73B and prior—

Mitsubishi Electric CorporationRT ToolBox31.82L and prior—

Mitsubishi Electric CorporationSetting/monitoring tools for the C Controller module (SW4PVC-CCPU)4.12N and prior—

Mitsubishi Electric CorporationSLMP Data Collector1.04E and prior—

06 References

www.mitsubishielectric.comhttps://www.mitsubishielectric.com/psirt/vulnerability/pdf/2020-021_en.pdfvendor-advisory
jvn.jphttps://jvn.jp/vu/JVNVU92330101government-resource
www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-21-049-02government-resource
www.mitsubishielectric.comhttps://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-021_en.pdfvendor-advisory
jvn.jphttps://jvn.jp/vu/JVNVU92330101/index.htmlgovernment-resource
us-cert.cisa.govhttps://us-cert.cisa.gov/ics/advisories/icsa-21-049-02government-resource