LiveActive security incident?Get immediate response
CVE Record

CVE-2019-10976: Mitsubishi Electric FR Configurator2, Version 1.16S and prior.

Mitsubishi Electric FR Configurator2, Version 1.16S and prior. This vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project and/or template file (.frc2). Once a user opens the file, the attacker could read arbitrary files.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

FR Configurator2 can be tricked into reading local files when a user opens a malicious project or template file. This affects Version 1.16S and prior. The main business concern is exposure of sensitive files on engineering workstations, not a remotely triggered compromise based on the provided evidence.

Executive priority

Treat this as a targeted engineering-workstation data exposure risk. Prioritize inventory and vendor-guided remediation where FR Configurator2 is used, especially in operational technology environments that exchange project files externally.

Technical view

CVE-2019-10976 is a CWE-611 XML External Entity issue in Mitsubishi Electric FR Configurator2. Unsanitized input reaches the XML parser while parsing .frc2 project or template files. Opening a crafted file may allow arbitrary local file read. No CVSS score or vendor fix version is included in the provided bundle.

Likely exposure

Organizations using Mitsubishi Electric FR Configurator2 Version 1.16S or earlier are exposed, especially where .frc2 files are received from external parties, shared across teams, or opened on engineering workstations containing sensitive data.

Exploitation context

The provided sources describe user-assisted exploitation through opening a malicious .frc2 file. The bundle does not show CISA KEV listing, active exploitation, public exploit use, or remote unauthenticated exploitation.

Researcher notes

Evidence supports an XXE-style arbitrary file read triggered during .frc2 XML parsing. The source bundle lacks CVSS details, exploit maturity, patch version, and deeper parser behavior. Avoid assuming broader product impact beyond FR Configurator2 Version 1.16S and prior.

Mitigation direction

  • Identify FR Configurator2 installations and versions across engineering workstations.
  • Check Mitsubishi Electric and CISA advisory guidance for supported remediation.
  • Do not open .frc2 files from untrusted or unexpected sources.
  • Use least-privilege accounts for engineering workstation activity.
  • Keep project and template file exchange within trusted channels.

Validation and detection

  • Confirm whether FR Configurator2 Version 1.16S or earlier is installed.
  • Review how .frc2 project and template files enter the organization.
  • Verify users know to treat unexpected .frc2 files as untrusted.
  • Check whether vendor guidance has been applied or formally tracked.
  • Review workstation data exposure if affected users opened suspicious files.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-611: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2019-10976 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Mitsubishi ElectricMitsubishi Electric FR Configurator2Version 1.16S and priorListed
Weakness

CWE details

CWE-611

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-611 · source CWE mapping

Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs