CVE-2020-5652

high-risk
Published 2020-11-02

Uncontrolled resource consumption vulnerability in Ethernet Port on MELSEC iQ-R, Q and L series CPU modules (R 00/01/02 CPU firmware versions '20' and earlier, R 04/08/16/32/120 (EN) CPU firmware versions '52' and earlier, R 08/16/32/120 SFCPU firmware versions '22' and earlier, R 08/16/32/120 PCPU all versions, R 08/16/32/120 PSFCPU all versions, R 16/32/64 MTCPU all versions, Q03 UDECPU, Q 04/06/10/13/20/26/50/100 UDEHCPU serial number '22081' and earlier , Q 03/04/06/13/26 UDVCPU serial number '22031' and earlier, Q 04/06/13/26 UDPVCPU serial number '22031' and earlier, Q 172/173 DCPU all versions, Q 172/173 DSCPU all versions, Q 170 MCPU all versions, Q 170 MSCPU all versions, L 02/06/26 CPU (-P) and L 26 CPU - (P) BT all versions) allows a remote unauthenticated attacker to stop the Ethernet communication functions of the products via a specially crafted packet, which may lead to a denial of service (DoS) condition .

Do I need to act?

~
3.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Melsec Q-Q04Udpvcpu Firmware
Melsec Q-Q06Udpvcpu Firmware
Melsec Q-Q13Udpvcpu Firmware
Melsec Q-Q26Udpvcpu Firmware
Melsec Q-Q03Udvcpu Firmware
Melsec Q-Q04Udvcpu Firmware
Melsec Q-Q13Udvcpu Firmware
Melsec Q-Q26Udvcpu Firmware
Melsec Q-Q03Udecpu Firmware
Melsec Q-Q04Udehcpu Firmware
Melsec Q-Q06Udehcpu Firmware
Melsec Q-Q10Udehcpu Firmware
Melsec Q-Q13Udehcpu Firmware
Melsec Q-Q20Udehcpu Firmware
Melsec Q-Q26Udehcpu Firmware
Melsec Q-Q50Udehcpu Firmware
Melsec Q-Q100Udehcpu Firmware
Melsec Iq-R08Sfcpu Firmware
Melsec Iq-R16Sfcpu Firmware
Melsec Iq-R32Sfcpu Firmware

Affected Vendors

58
/ 100
high-risk
Severity 26/34 · High
Exploitability 6/34 · Minimal
Exposure 26/34 · High