CVE-2020-5602

mediumpriority · track · 31EPSS 0.014 · 73 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.43% (73rd) EPSS

CVSS 5 · medium

Is it mine?

61 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · scored 2026-10-27

Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit (EM Configurator) Ver. 1.010L and earlier, GT Designer3 (GOT2000) Ver. 1.221F and earlier, GX LogViewer Ver. 1.96A and earlier, GX Works2 Ver. 1.586L and earlier, GX Works3 Ver. 1.058L and earlier, M_CommDTM-HART Ver. 1.00A, M_CommDTM-IO-Link Ver. 1.02C and earlier, MELFA-Works Ver. 4.3 and earlier, MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool Ver.1.004E and earlier, MELSOFT FieldDeviceConfigurator Ver. 1.03D and earlier, MELSOFT iQ AppPortal Ver. 1.11M and earlier, MELSOFT Navigator Ver. 2.58L and earlier, MI Configurator Ver. 1.003D and earlier, Motion Control Setting Ver. 1.005F and earlier, MR Configurator2 Ver. 1.72A and earlier, MT Works2 Ver. 1.156N and earlier, RT ToolBox2 Ver. 3.72A and earlier, and RT ToolBox3 Ver. 1.50C and earlier) allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vectors.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCPU Module Logging Configuration Toolcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedCW Configuratorcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedEM Software Development Kit (EM Configurator)cisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedGT Designer3 (GOT2000)cisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedGX LogViewercisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedGX Works2cisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedGX Works3cisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMELFA-Workscisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMELSEC-L Flexible High-Speed I/O Control Module Configuration Toolcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMELSOFT FieldDeviceConfiguratorcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMELSOFT Navigatorcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMELSOFT iQ AppPortalcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMI Configuratorcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMR Configurator2cisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMT Works2cisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedM_CommDTM-HARTcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedM_CommDTM-IO-Linkcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedMotion Control Settingcisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedRT ToolBox2cisa_csaf_ot
GX LogViewer: Version 1.100E or later
FixedRT ToolBox3cisa_csaf_ot
GX LogViewer: Version 1.100E or later
MitigationCPU Module Logging Configuration Toolcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationCW Configuratorcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationEM Software Development Kit (EM Configurator)cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationGT Designer3 (GOT2000)cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationGX LogViewercisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationGX Works2cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationGX Works3cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELFA-Workscisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELSEC-L Flexible High-Speed I/O Control Module Configuration Toolcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELSOFT FieldDeviceConfiguratorcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELSOFT Navigatorcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMELSOFT iQ AppPortalcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMI Configuratorcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMR Configurator2cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMT Works2cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationM_CommDTM-HARTcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationM_CommDTM-IO-Linkcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationMotion Control Settingcisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationRT ToolBox2cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later
MitigationRT ToolBox3cisa_csaf_ot
CPU Module Logging Configuration Too: Version 1.100E or later

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.05.3mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nsecondary · CISA US

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-611USprimaryCWE-611US

affected products (61)

Products and version ranges known to be affected.

CPU Module Logging Configuration Tool: Versions 1.94Y and priorall versionscisa_csaf_otUS
CW Configurator: Versions 1.010L and priorall versionscisa_csaf_otUS
EM Software Development Kit (EM Configurator): Versions 1.010L and priorall versionscisa_csaf_otUS
GT Designer3 (GOT2000): Versions 1.221F and priorall versionscisa_csaf_otUS
GX LogViewer: Versions 1.96A and priorall versionscisa_csaf_otUS
GX Works2: Versions 1.586L and priorall versionscisa_csaf_otUS
GX Works3: Versions 1.058L and priorall versionscisa_csaf_otUS
MELFA-Works: Versions 4.3 and priorall versionscisa_csaf_otUS
MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool: Versions 1.004E and priorall versionscisa_csaf_otUS
MELSOFT FieldDeviceConfigurator: Versions 1.03D and priorall versionscisa_csaf_otUS
MELSOFT Navigator: Versions 2.58L and priorall versionscisa_csaf_otUS
MELSOFT iQ AppPortal: Versions 1.11M and priorall versionscisa_csaf_otUS
MI Configurator: Versions 1.003D and priorall versionscisa_csaf_otUS
MR Configurator2: Versions 1.72A and priorall versionscisa_csaf_otUS
MT Works2: Versions 1.156N and priorall versionscisa_csaf_otUS
M_CommDTM-HART: Version 1.00Aall versionscisa_csaf_otUS
M_CommDTM-IO-Link: Versions 1.02C and priorall versionscisa_csaf_otUS
Motion Control Setting: Versions 1.005F and priorall versionscisa_csaf_otUS
RT ToolBox2: Versions 3.72A and priorall versionscisa_csaf_otUS
RT ToolBox3: Versions 1.50C and priorall versionscisa_csaf_otUS

showing 20 of 61

advisories (1)

Vendor and ecosystem advisories describing this.

ICSA-20-182-02Mitsubishi Electric Factory Automation Engineering Software Products2020-06-30icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could allow a local attacker to send files outside of the system as well as cause a denial-of-service condition.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot NVD CVE.org MITRE

published 2020-06-30modified 2026-06-17

related (1,520)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2025-58360US	critical9.8OT critical	61.2% (99th)	KEV	2025-11-25
GeoServer is an open source server that allows users to share and edit geospatial data. From version 2.26.0 to before 2.26.2 and before 2.25.6, an XML External Entity (XXE) vulnera…
CVE-2025-2776US	critical9.8OT critical	64.7% (99th)	KEV	2025-05-07
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Server URL processing functionality, allowing for administrat…
CVE-2025-2775US	high7.5OT critical	42.6% (99th)	KEV	2025-05-07
SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the Checkin processing functionality, allowing for administrator…
CVE-2024-34102US	—OT critical	100.0% (100th)	KEV	2024-06-13
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could re…
CVE-2023-45727US	high7.5OT critical	4.82% (92nd)	KEV	2023-10-18
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthent…

+1515 more

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan