136
CVEs
37
Critical
72
High
0
KEV
8
PoC
100
Unpatched C/H
8.1%
Patch Rate
3.5%
Avg EPSS
Severity Breakdown
CRITICAL
37
HIGH
72
MEDIUM
26
LOW
1
Monthly CVE Trend
Affected Products (30)
Gx Works3
25
Genesis64
23
Gx Works2
18
Gt Softgot2000
14
Mi Configurator
13
Cw Configurator
13
Cpu Module Logging Configuration Tool
13
Gx Logviewer
13
Rt Toolbox3
13
Ezsocket
13
Coreos
12
Mr Configurator2
11
Fr Configurator Sw3
11
Gt Softgot1000
11
Mx Component
11
Data Transfer
11
Fr Configurator2
11
Gx Developer
11
Fx5Uj 40Mt Es Firmware
10
Fx5Uc 32Mt Dss Ts Firmware
10
Fx5Uj 40Mr Es Firmware
10
Fx5Uj 60Mt Es Firmware
10
Fx5Uj 60Mt Ess Firmware
10
Fx5Uj 24Mr Es Firmware
10
Fx5Uj 60Mr Es Firmware
10
Mc Works64
10
Fx5Uj 40Mt Ess Firmware
10
Fx5Uc 32Mt Dss Firmware
10
Fx5Uj 24Mt Ess Firmware
10
Fx5Uc 32Mt D Firmware
10
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2013-2817 | An ActiveX control in IcoLaunch.dll in Mitsubishi Electric Automation MC-WorX Suite 8.02 allows user-assisted remote attackers to execute arbitrary programs via a crafted HTML document in conjunction. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 35.8%. | CRITICAL | 9.3 | 35.8% | 102 |
PoC
|
| CVE-2019-14926 | An issue was discovered on Mitsubishi Electric Europe B.V. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 2.1% | 69 |
PoC
No patch
|
| CVE-2019-14929 | An issue was discovered on Mitsubishi Electric Europe B.V. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 1.9% | 69 |
PoC
No patch
|
| CVE-2019-14930 | An issue was discovered on Mitsubishi Electric Europe B.V. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 2.3% | 69 |
PoC
No patch
|
| CVE-2019-14931 | An issue was discovered on Mitsubishi Electric Europe B.V. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 57.7% | 69 |
PoC
No patch
|
| CVE-2019-14927 | An issue was discovered on Mitsubishi Electric Europe B.V. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 41.8% | 58 |
PoC
No patch
|
| CVE-2019-14925 | An issue was discovered on Mitsubishi Electric Europe B.V. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available. | MEDIUM | 6.5 | 1.3% | 52 |
PoC
No patch
|
| CVE-2020-5531 | Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User Ethernet port (CH1, CH2): First 5 digits of serial number. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 2.0% | 49 |
No patch
|
| CVE-2020-5542 | Buffer error vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to stop the network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application. | CRITICAL | 9.8 | 2.3% | 49 |
|
| CVE-2020-5543 | TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier does not properly manage sessions, which allows remote attackers to stop. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | CRITICAL | 9.8 | 2.1% | 49 |
|
| CVE-2020-5544 | Null Pointer Dereference vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to stop. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | CRITICAL | 9.8 | 2.4% | 49 |
|
| CVE-2020-5545 | TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to bypass access restriction and to stop the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | CRITICAL | 9.8 | 2.3% | 49 |
|
| CVE-2020-5547 | Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | CRITICAL | 9.8 | 2.3% | 49 |
|
| CVE-2020-5594 | Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series CPU modules all versions contain a vulnerability that allows cleartext transmission of sensitive information between CPU modules and GX. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 1.3% | 49 |
No patch
|
| CVE-2020-5595 | TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a buffer overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 2.5% | 49 |
No patch
|