CVE-2019-10976
MEDIUMMitsubishi Electric FR Configurator2 < 1.16s - XML External Entity Injection via Project/Template File Parsing
Title source: llmDescription
Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.
References (1)
Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-19-204-01
Scores
CVSS v3
5.5
EPSS
0.0021
EPSS Percentile
42.5%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
CWE
CWE-611
Status
published
Products (1)
mitsubishielectric/electric_fr_configurator2_firmware
< 1.16s
Published
Jul 26, 2019
Tracked Since
Feb 18, 2026