CVE-2020-5603 : Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Conf

Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit (EM Configurator) Ver. 1.010L and earlier, GT Designer3 (GOT2000) Ver. 1.221F and earlier, GX LogViewer Ver. 1.96A and earlier, GX Works2 Ver. 1.586L and earlier, GX Works3 Ver. 1.058L and earlier, M_CommDTM-HART Ver. 1.00A, M_CommDTM-IO-Link Ver. 1.02C and earlier, MELFA-Works Ver. 4.3 and earlier, MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool Ver.1.004E and earlier, MELSOFT FieldDeviceConfigurator Ver. 1.03D and earlier, MELSOFT iQ AppPortal Ver. 1.11M and earlier, MELSOFT Navigator Ver. 2.58L and earlier, MI Configurator Ver. 1.003D and earlier, Motion Control Setting Ver. 1.005F and earlier, MR Configurator2 Ver. 1.72A and earlier, MT Works2 Ver. 1.156N and earlier, RT ToolBox2 Ver. 3.72A and earlier, and RT ToolBox3 Ver. 1.50C and earlier) allows an attacker to cause a denial of service (DoS) condition attacks via unspecified vectors.

Published 2020-06-30 11:15:11

Updated 2020-07-09 16:40:15

Source JPCERT/CC

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2020-5603

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 45 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-5603

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2020-5603

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-5603

Products affected by CVE-2020-5603

Mitsubishielectric » Cpu Module Logging Configuration Tool
Versions up to, including, (<=) 1.94y
cpe:2.3:a:mitsubishielectric:cpu_module_logging_configuration_tool:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Cw Configurator
Versions up to, including, (<=) 1.010l
cpe:2.3:a:mitsubishielectric:cw_configurator:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Gx Logviewer
Versions up to, including, (<=) 1.100e
cpe:2.3:a:mitsubishielectric:gx_logviewer:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Gx Works2
Versions up to, including, (<=) 1.590q
cpe:2.3:a:mitsubishielectric:gx_works2:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Gx Works3
Versions up to, including, (<=) 1.060n
cpe:2.3:a:mitsubishielectric:gx_works3:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » M Commdtm-hart
Versions up to, including, (<=) 1.01b
cpe:2.3:a:mitsubishielectric:m_commdtm-hart:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » M Commdtm-io-link
Versions up to, including, (<=) 1.03d
cpe:2.3:a:mitsubishielectric:m_commdtm-io-link:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Melfa-works
Versions up to, including, (<=) 4.4
cpe:2.3:a:mitsubishielectric:melfa-works:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Melsoft Navigator
Versions up to, including, (<=) 2.62q
cpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Mi Configurator
Versions up to, including, (<=) 1.004e
cpe:2.3:a:mitsubishielectric:mi_configurator:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Mt Works2
Versions up to, including, (<=) 1.160s
cpe:2.3:a:mitsubishielectric:mt_works2:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Rt Toolbox2
Versions up to, including, (<=) 3.73b
cpe:2.3:a:mitsubishielectric:rt_toolbox2:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Rt Toolbox3
Versions up to, including, (<=) 1.60n
cpe:2.3:a:mitsubishielectric:rt_toolbox3:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Em Configurator
Versions up to, including, (<=) 1.010l
cpe:2.3:a:mitsubishielectric:em_configurator:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Gt Designer3
Versions up to, including, (<=) 1.221f
cpe:2.3:a:mitsubishielectric:gt_designer3:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Melsec-l Flexible High-speed I/o Control Module Configuration Tool
Versions up to, including, (<=) 1.005f
cpe:2.3:a:mitsubishielectric:melsec-l_flexible_high-speed_i\/o_control_module_configuration_tool:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Melsoft Fielddeviceconfigurator
Versions up to, including, (<=) 1.04e
cpe:2.3:a:mitsubishielectric:melsoft_fielddeviceconfigurator:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Melsoft Iq Appportal
Versions up to, including, (<=) 1.14q
cpe:2.3:a:mitsubishielectric:melsoft_iq_appportal:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Motion Control Setting
Versions up to, including, (<=) 1.006g
cpe:2.3:a:mitsubishielectric:motion_control_setting:*:*:*:*:*:*:*:*
Matching versions
Mitsubishielectric » Mr Configurator2
Versions up to, including, (<=) 1.100e
cpe:2.3:a:mitsubishielectric:mr_configurator2:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-5603

Exploit prediction scoring system (EPSS) score for CVE-2020-5603

CVSS scores for CVE-2020-5603

CWE ids for CVE-2020-5603

References for CVE-2020-5603

Products affected by CVE-2020-5603