Medium severity · published Jul 25, 2019
CVE-2019-10976
Mitsubishi Electric FR Configurator2, Version 1.16S and prior
5.5
CVSS
1%
EPSS
No
On KEV
Description
Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ME
Mitsubishi Electric FR Configurator2 · Mitsubishi Electric
Version 1.16S and prior · source: vendor
EF
Electric FR Configurator2 Firmware · Mitsubishielectric
before 1.16s · source: NVD
Affected product
ME
Mitsubishi Electric FR Configurator2
Mitsubishi Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10976
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-19-204-01
More from Mitsubishi Electric FR Configurator2
5.5
CVE-2019-10972
Mitsubishi Electric FR Configurator2, Version 1.16S and prior