CVE-2020-5602

Vulnerability

CVE-2020-5602 is an XML External Entity (XXE) vulnerability (CWE-611) present in multiple Mitsubishi Electric FA Engineering Software products, including CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, and many others (see reference [1] for full list). The vulnerability arises from improper restriction of XML external entity references when processing XML data.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted project file or settings data file. No authentication or user interaction beyond opening the file is required. The attack vector is local (AV:L) and requires no privileges (PR:N). The attacker does not need any special network position; the malicious file can be delivered via email, download, or other means.

Impact

Successful exploitation allows an attacker to read arbitrary files on the local system where the affected software is running. The CVSS v3 base score is 4.0 (Low), with confidentiality impact rated as Low, and no impact on integrity or availability. The attacker gains access to file contents that the software process can read, potentially exposing sensitive information.

Mitigation

Mitsubishi Electric has released updated versions of the affected software to address this vulnerability. Users should update to the latest versions as specified in the vendor's advisory [1]. No workarounds are documented; the recommended mitigation is to apply the patches. As of the publication date (2020-06-30), fixed versions are available.