CVE-2020-5666

Published: Nov 16, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51') allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.

Affected (8)

Products: Mitsubishielectric: Melsec Iq R00 Firmware, Melsec Iq R01 Firmware, Melsec Iq R02 Firmware, Melsec Iq R04 Firmware, Melsec Iq R16 Firmware, Melsec Iq R08 Firmware, Melsec Iq R32 Firmware, Melsec Iq R120 Firmware

Mitsubishielectric

8 products

Melsec Iq R00 Firmware

Melsec Iq R01 Firmware

Melsec Iq R02 Firmware

Melsec Iq R04 Firmware

Melsec Iq R16 Firmware

Melsec Iq R08 Firmware

Melsec Iq R32 Firmware

Melsec Iq R120 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric Melsec Iq R00 Firmware	From 05 to 19

Running on/with	Platform Versions
Mitsubishielectric Melsec Iq R00	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric Melsec Iq R01 Firmware	From 05 to 19

Running on/with	Platform Versions
Mitsubishielectric Melsec Iq R01	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric Melsec Iq R02 Firmware	From 05 to 19

Running on/with	Platform Versions
Mitsubishielectric Melsec Iq R02	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric Melsec Iq R04 Firmware	From 35 to 51

Running on/with	Platform Versions
Mitsubishielectric Melsec Iq R04	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric Melsec Iq R16 Firmware	From 35 to 51

Running on/with	Platform Versions
Mitsubishielectric Melsec Iq R16	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric Melsec Iq R08 Firmware	From 35 to 51

Running on/with	Platform Versions
Mitsubishielectric Melsec Iq R08	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric Melsec Iq R32 Firmware	From 35 to 51

Running on/with	Platform Versions
Mitsubishielectric Melsec Iq R32	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric Melsec Iq R120 Firmware	From 35 to 51

Running on/with	Platform Versions
Mitsubishielectric Melsec Iq R120	All versions

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (8)

https://jvn.jp/en/jp/JVN44764844/index.html

Source: vultures@jpcert.or.jp

Third Party Advisory

https://jvn.jp/jp/JVN44764844/index.html

Source: vultures@jpcert.or.jp

Third Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01

Source: vultures@jpcert.or.jp

Third Party AdvisoryUS Government Resource

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf

Source: vultures@jpcert.or.jp

MitigationVendor Advisory

https://jvn.jp/en/jp/JVN44764844/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://jvn.jp/jp/JVN44764844/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

Timeline

No history available yet.