CVE-2019-14931
CriticalExploitedPublic exploitAn issue was discovered on Mitsubishi Electric Europe B.V.
Published Sep 10, 2021 · Updated Sep 10, 2024
Key Facts
Patch immediately- CVE-2019-14931 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Me-Rtu Firmware (Inea), Smartrtu Firmware (Mitsubishielectric).
- It is exploited in the wild, listed in Industry KEV feed since Dec 13, 2019. Public exploit code is available.
- EPSS estimates a 57% probability of exploitation in the next 30 days.
- Fixed versions are available, including Me-Rtu Firmware <=3.0, Smartrtu Firmware <=2.02, Me-Rtu Firmware 3.0.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
57%
Higher than 99.0% of all scored CVEs
Exploited in the wild
Yes
1 catalog listing
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2019-14931 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| Industry KEV feed | Dec 13, 2019 | n/a | Not reported |
Required action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Me-Rtu FirmwareInea | See advisory | 3.0 |
| Smartrtu FirmwareMitsubishielectric | See advisory | 2.02 |
Patched Releases
Me-Rtu Firmware
<=3.0
Smartrtu Firmware
<=2.02
Timeline
Added to Industry KEV feed
Dec 13, 2019
Publicly disclosed
Sep 10, 2021
Last updated
Sep 10, 2024
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryhttps://us-cert.cisa.gov/ics/advisories/icsa-21-252-03
- advisoryhttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- advisoryhttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- advisoryhttps://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- advisoryhttps://www.mogozobo.com/
FAQ
Common Questions.
An issue was discovered on Mitsubishi Electric Europe B.V.
Affected: Me-Rtu Firmware (Inea); Smartrtu Firmware (Mitsubishielectric). The full list is in the CVE brief.
It is exploited in the wild, listed in Industry KEV feed since Dec 13, 2019.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Me-Rtu Firmware <=3.0, Smartrtu Firmware <=2.02, Me-Rtu Firmware 3.0.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2019-14931 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo