RCE in Inea Me-Rtu

CVE-2019-14931

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data.

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.574 (99.1th percentile), scored .

High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2019-14931: fell from 0.581 to 0.574.

EPSS over last 30 days · oldest: 0.581 · newest: 0.574 · change: -0.007

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2019-14931?
CVE-2019-14931 is a critical-severity vulnerability in Inea Me-Rtu, classified under OS Command Injection. CVSS score: 9.8/10. Published 2019-10-28.
How severe is CVE-2019-14931?
Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2019-14931 known to be exploited?
2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.