CVE-2019-14931

This vulnerability is like leaving a “mobile test” button exposed on a control device, and letting someone type in special characters that trick the device into running commands on its own operating system. Because it’s unauthenticated, a remote attacker doesn’t need to log in first. Successful exploitation can let an attacker fully control the device, read sensitive information, and change settings—potentially disrupting operations.

This matters if you use or operate Mitsubishi Electric ME-RTU devices running “smartrtu/me-rtu” firmware within the affected version ranges (through 2.02 for ME-RTU and through 3.0 for INEA ME-RTU). It’s a risk when the vulnerable Mobile Connection Test functionality (mobile.php/action.php) is reachable from the network, which the findings state is true in default configuration. Because there’s no authentication required, the key gate is network reachability to the feature—if it’s reachable from untrusted networks (for example, the internet), you should assume exposure.

This is RED because the vulnerability has been exploited in the wild by the Evooo1Bot Linux botnet, meaning attackers are actively targeting these devices. It’s also critical because it allows unauthenticated remote command execution, including full device control. There is no patch information available in the provided findings, so you must urgently reduce exposure while you pursue a confirmed fixed firmware.

1. Confirm affected devices and versions

• Identify all Mitsubishi Electric ME-RTU units in your environment (including smartrtu/me-rtu deployments) and record firmware versions.
• Mark any devices that are on versions through 2.02 (ME-RTU) or through 3.0 (INEA ME-RTU).

2. Confirm whether the vulnerable feature is reachable

• Determine whether the Mobile Connection Test feature is accessible from outside your trusted network.
• Validate whether mobile.php/action.php are reachable from untrusted sources (directly or through a proxy/portal).
• If you don’t have direct visibility, ask your integrator/IT team to check exposed services and access logs for requests tied to Mobile Connection Test.

3. Immediate containment (if reachable)

• Restrict network access to the ME-RTU units so the internet and untrusted networks cannot reach the Mobile Connection Test functionality.
• Use firewall rules/segmentation/VPN-only access so only known management hosts can reach the device.

4. Remediation planning (since no fix is listed in provided findings)

• Contact Mitsubishi Electric support or your device vendor/integrator and request:
  • A confirmed firmware/patch release that remediates CVE-2019-14931.
  • The exact version numbers for each affected product line/branch.
  • Any interim configuration guidance if patching cannot happen immediately.
• Do not assume a generic “security update” fixes this unless the vendor explicitly ties it to CVE-2019-14931.

5. If compromise is suspected or found

• Preserve evidence: device logs, firewall logs, and any application/system logs you can collect.
• Hunt for signs of unauthorized command execution and unusual behavior (unexpected outbound traffic, configuration changes, or device instability).
• Restore from known-good configuration after mitigation, and consider rotating any credentials used by your operations environment.

6. Ongoing monitoring

• Continue to monitor network traffic to the ME-RTU management interfaces and any paths associated with Mobile Connection Test.
• Track vendor communications for fixed firmware; once available, schedule patching as a priority.

CVE-2019-14931 (CWE-78) is a remote OS Command Injection affecting Mitsubishi Electric ME-RTU devices. The mechanism is lack of input sanitization in the Mobile Connection Test flow: mobile.php triggers backend action.php, which executes a “ping” style test using a user-controlled host parameter. Because the input is handled unsafely, an attacker can inject shell command separators (e.g., ;) to execute arbitrary commands on the device.

Exposure and access: it is unauthenticated (no login required) and does not require user interaction; the findings state it is reachable in default configuration when the vulnerable mobile.php/action.php functionality is accessible from the network.

Exploitation status: while no public exploit code is listed, exploitation has been reported as YES via the Evooo1Bot Linux botnet actively targeting these ME-RTU devices since July 2026. KEV (CISA) is not listed in the provided findings.

Patch status: the provided findings explicitly state no patch/firmware fix information is available. That means defenders must rely on containment (network restriction) and vendor guidance until a fixed version is confirmed.

Risk maturity: given unauthenticated remote command execution and confirmed in-the-wild botnet activity, this is treated as actively weaponized rather than theoretical.