CVE-2019-14931

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data.

• CWE-78

• https://www.mogozobo.com/Third Party Advisory
• https://www.mogozobo.com/?p=3593Exploit, Third Party Advisory
• https://www.mogozobo.com/Third Party Advisory
• https://www.mogozobo.com/?p=3593Exploit, Third Party Advisory

Published

Oct 28, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-14926An issue was discovered on Mitsubishi Electric Europe B.V. M…9.8
• CVE-2019-14927An issue was discovered on Mitsubishi Electric Europe B.V. M…7.5
• CVE-2019-14928An issue was discovered on Mitsubishi Electric Europe B.V. M…5.4
• CVE-2019-14929An issue was discovered on Mitsubishi Electric Europe B.V. M…9.8
• CVE-2019-1493Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-14930An issue was discovered on Mitsubishi Electric Europe B.V. M…9.8
• CVE-2019-14932The Recruitment module in Humanica Humatrix 7 1.0.0.681 and …
• CVE-2019-14933Bagisto 0.1.5 allows CSRF under /admin URIs.
• CVE-2019-14934An issue was discovered in PDFResurrect before 0.18. pdf_loa…7.8
• CVE-2019-149353CX Phone 15 on Windows has insecure permissions on the "%PR…
• CVE-2019-14936Easy!Appointments 1.3.2 plugin for WordPress allows Sensitiv…5.3
• CVE-2019-14937REDCap before 9.3.0 allows time-based SQL injection in the e…