CVE-2019-14931

This vulnerability is like leaving a “mobile test” button exposed on a control device, and letting someone type in special characters that trick the device into running commands on its own operating system. Because it’s unauthenticated, a remote attacker doesn’t need to log in first. Successful exploitation can let an attacker fully control the device, read sensitive information, and change settings—potentially disrupting operations.

This matters if you use or operate Mitsubishi Electric ME-RTU devices running “smartrtu/me-rtu” firmware within the affected version ranges (through 2.02 for ME-RTU and through 3.0 for INEA ME-RTU). It’s a risk when the vulnerable Mobile Connection Test functionality (mobile.php/action.php) is reachable from the network, which the findings state is true in default configuration. Because there’s no authentication required, the key gate is network reachability to the feature—if it’s reachable from untrusted networks (for example, the internet), you should assume exposure.

This is RED because the vulnerability has been exploited in the wild by the Evooo1Bot Linux botnet, meaning attackers are actively targeting these devices. It’s also critical because it allows unauthenticated remote command execution, including full device control. There is no patch information available in the provided findings, so you must urgently reduce exposure while you pursue a confirmed fixed firmware.