CVE-2020-5602

mediumPriorität · verfolgen · 31EPSS 0.014 · 73. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.43% (73rd) EPSS

CVSS 5 · medium

Is it mine?

61 products

Prüfe deine Angriffsfläche

Who says so?

3 sources

cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · bewertet 2026-10-27

Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit (EM Configurator) Ver. 1.010L and earlier, GT Designer3 (GOT2000) Ver. 1.221F and earlier, GX LogViewer Ver. 1.96A and earlier, GX Works2 Ver. 1.586L and earlier, GX Works3 Ver. 1.058L and earlier, M_CommDTM-HART Ver. 1.00A, M_CommDTM-IO-Link Ver. 1.02C and earlier, MELFA-Works Ver. 4.3 and earlier, MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool Ver.1.004E and earlier, MELSOFT FieldDeviceConfigurator Ver. 1.03D and earlier, MELSOFT iQ AppPortal Ver. 1.11M and earlier, MELSOFT Navigator Ver. 2.58L and earlier, MI Configurator Ver. 1.003D and earlier, Motion Control Setting Ver. 1.005F and earlier, MR Configurator2 Ver. 1.72A and earlier, MT Works2 Ver. 1.156N and earlier, RT ToolBox2 Ver. 3.72A and earlier, and RT ToolBox3 Ver. 1.50C and earlier) allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenCPU Module Logging Configuration Toolcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenCW Configuratorcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenEM Software Development Kit (EM Configurator)cisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenGT Designer3 (GOT2000)cisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenGX LogViewercisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenGX Works2cisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenGX Works3cisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMELFA-Workscisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMELSEC-L Flexible High-Speed I/O Control Module Configuration Toolcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMELSOFT FieldDeviceConfiguratorcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMELSOFT Navigatorcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMELSOFT iQ AppPortalcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMI Configuratorcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMR Configurator2cisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMT Works2cisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenM_CommDTM-HARTcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenM_CommDTM-IO-Linkcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenMotion Control Settingcisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenRT ToolBox2cisa_csaf_ot
GX LogViewer: Version 1.100E or later
BehobenRT ToolBox3cisa_csaf_ot
GX LogViewer: Version 1.100E or later
MitigationCPU Module Logging Configuration Toolcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationCW Configuratorcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationEM Software Development Kit (EM Configurator)cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationGT Designer3 (GOT2000)cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationGX LogViewercisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationGX Works2cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationGX Works3cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELFA-Workscisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELSEC-L Flexible High-Speed I/O Control Module Configuration Toolcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELSOFT FieldDeviceConfiguratorcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELSOFT Navigatorcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELSOFT iQ AppPortalcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMI Configuratorcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMR Configurator2cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMT Works2cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationM_CommDTM-HARTcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationM_CommDTM-IO-Linkcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMotion Control Settingcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationRT ToolBox2cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationRT ToolBox3cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.5

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-611USprimärCWE-611US

betroffene Produkte (61)

Betroffene Produkte und Versionsbereiche.

CPU Module Logging Configuration Tool: Versions 1.94Y and prioralle Versionencisa_csaf_otUS
CW Configurator: Versions 1.010L and prioralle Versionencisa_csaf_otUS
EM Software Development Kit (EM Configurator): Versions 1.010L and prioralle Versionencisa_csaf_otUS
GT Designer3 (GOT2000): Versions 1.221F and prioralle Versionencisa_csaf_otUS
GX LogViewer: Versions 1.96A and prioralle Versionencisa_csaf_otUS
GX Works2: Versions 1.586L and prioralle Versionencisa_csaf_otUS
GX Works3: Versions 1.058L and prioralle Versionencisa_csaf_otUS
MELFA-Works: Versions 4.3 and prioralle Versionencisa_csaf_otUS
MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool: Versions 1.004E and prioralle Versionencisa_csaf_otUS
MELSOFT FieldDeviceConfigurator: Versions 1.03D and prioralle Versionencisa_csaf_otUS
MELSOFT Navigator: Versions 2.58L and prioralle Versionencisa_csaf_otUS
MELSOFT iQ AppPortal: Versions 1.11M and prioralle Versionencisa_csaf_otUS
MI Configurator: Versions 1.003D and prioralle Versionencisa_csaf_otUS
MR Configurator2: Versions 1.72A and prioralle Versionencisa_csaf_otUS
MT Works2: Versions 1.156N and prioralle Versionencisa_csaf_otUS
M_CommDTM-HART: Version 1.00Aalle Versionencisa_csaf_otUS
M_CommDTM-IO-Link: Versions 1.02C and prioralle Versionencisa_csaf_otUS
Motion Control Setting: Versions 1.005F and prioralle Versionencisa_csaf_otUS
RT ToolBox2: Versions 3.72A and prioralle Versionencisa_csaf_otUS
RT ToolBox3: Versions 1.50C and prioralle Versionencisa_csaf_otUS

20 von 61 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-20-182-02Mitsubishi Electric Factory Automation Engineering Software Products2020-06-30icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow a local attacker to send files outside of the system as well as cause a denial-of-service condition.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2020-06-30geändert 2026-06-17

verwandt (1,520)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-58360US	critical9.8OT kritisch	61.2% (99th)	KEV	2025-11-25
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnera…
CVE-2025-2776US	critical9.8OT kritisch	64.7% (99th)	KEV	2025-05-07
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrat…
CVE-2025-2775US	high7.5OT kritisch	42.6% (99th)	KEV	2025-05-07
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator…
CVE-2024-34102US	—OT kritisch	100.0% (100th)	KEV	2024-06-13
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could re…
CVE-2023-45727US	high7.5OT kritisch	4.82% (92nd)	KEV	2023-10-18
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthent…

+1515 weitere

Referenzen (9)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan