CVE-2020-5668

high-risk

Published 2020-11-20

Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/120 (EN) CPU firmware version '51' and earlier, R08/16/32/120SFCPU firmware version '22' and earlier, R08/16/32/120PCPU firmware version '25' and earlier, R08/16/32/120PSFCPU firmware version '06' and earlier, RJ71EN71 firmware version '47' and earlier, RJ71GF11-T2 firmware version '47' and earlier, RJ72GF15-T2 firmware version '07' and earlier, RJ71GP21-SX firmware version '47' and earlier, RJ71GP21S-SX firmware version '47' and earlier, and RJ71GN11-T2 firmware version '11' and earlier) allows a remote unauthenticated attacker to cause an error in a CPU unit and cause a denial-of-service (DoS) condition in execution of the program and its communication, or to cause a denial-of-service (DoS) condition in communication via the unit by receiving a specially crafted SLMP packet

Do I need to act?

3.1% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

R00Cpu Firmware

R01Cpu Firmware

R02Cpu Firmware

R04Cpu Firmware

R08Cpu Firmware

R16Cpu Firmware

R32Cpu Firmware

R120Cpu Firmware

R08Sfcpu Firmware

R16Sfcpu Firmware

R32Sfcpu Firmware

R120Sfcpu Firmware

R08Pcpu Firmware

R16Pcpu Firmware

R32Pcpu Firmware

R120Pcpu Firmware

R08Psfcpu Firmware

R16Psfcpu Firmware

R32Psfcpu Firmware

R120Psfcpu Firmware

Affected Vendors

Mitsubishielectric

References (8)

Third Party Advisory https://jvn.jp/vu/JVNVU95980140/index.html

Third Party Advisory https://us-cert.cisa.gov/ics/advisories/icsa-20-324-05

Vendor Advisory https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-016.pdf

Vendor Advisory https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-016_en.pdf

Third Party Advisory https://jvn.jp/vu/JVNVU95980140/index.html

Third Party Advisory https://us-cert.cisa.gov/ics/advisories/icsa-20-324-05

Vendor Advisory https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-016.pdf

Vendor Advisory https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-016_en.pdf

/ 100

high-risk

Severity 26/34 · High

Exploitability 6/34 · Minimal

Exposure 22/34 · High