CVE-2020-5668 : Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R

Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/120 (EN) CPU firmware version '51' and earlier, R08/16/32/120SFCPU firmware version '22' and earlier, R08/16/32/120PCPU firmware version '25' and earlier, R08/16/32/120PSFCPU firmware version '06' and earlier, RJ71EN71 firmware version '47' and earlier, RJ71GF11-T2 firmware version '47' and earlier, RJ72GF15-T2 firmware version '07' and earlier, RJ71GP21-SX firmware version '47' and earlier, RJ71GP21S-SX firmware version '47' and earlier, and RJ71GN11-T2 firmware version '11' and earlier) allows a remote unauthenticated attacker to cause an error in a CPU unit and cause a denial-of-service (DoS) condition in execution of the program and its communication, or to cause a denial-of-service (DoS) condition in communication via the unit by receiving a specially crafted SLMP packet

Published 2020-11-20 04:15:11

Updated 2022-04-29 13:21:06

Source JPCERT/CC

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2020-5668

Mitsubishielectric » Rj71gn11-t2 Firmware
Versions up to, including, (<=) 11
cpe:2.3:o:mitsubishielectric:rj71gn11-t2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Rj71gn11-t2 » Version: N/A
Mitsubishielectric » Rj71en71 Firmware
Versions up to, including, (<=) 47
cpe:2.3:o:mitsubishielectric:rj71en71_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Rj71en71 » Version: N/A
Mitsubishielectric » R00cpu Firmware
Versions up to, including, (<=) 19
cpe:2.3:o:mitsubishielectric:r00cpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R00cpu » Version: N/A
Mitsubishielectric » R01cpu Firmware
Versions up to, including, (<=) 19
cpe:2.3:o:mitsubishielectric:r01cpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R01cpu » Version: N/A
Mitsubishielectric » R02cpu Firmware
Versions up to, including, (<=) 19
cpe:2.3:o:mitsubishielectric:r02cpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R02cpu » Version: N/A
Mitsubishielectric » R04cpu Firmware
Versions up to, including, (<=) 51
cpe:2.3:o:mitsubishielectric:r04cpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R04cpu » Version: N/A
Mitsubishielectric » R08cpu Firmware
Versions up to, including, (<=) 51
cpe:2.3:o:mitsubishielectric:r08cpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R08cpu » Version: N/A
Mitsubishielectric » R16cpu Firmware
Versions up to, including, (<=) 51
cpe:2.3:o:mitsubishielectric:r16cpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R16cpu » Version: N/A
Mitsubishielectric » R32cpu Firmware
Versions up to, including, (<=) 51
cpe:2.3:o:mitsubishielectric:r32cpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R32cpu » Version: N/A
Mitsubishielectric » R120cpu Firmware
Versions up to, including, (<=) 51
cpe:2.3:o:mitsubishielectric:r120cpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R120cpu » Version: N/A
Mitsubishielectric » R08sfcpu Firmware
Versions up to, including, (<=) 22
cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R08sfcpu » Version: N/A
Mitsubishielectric » R16sfcpu Firmware
Versions up to, including, (<=) 22
cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R16sfcpu » Version: N/A
Mitsubishielectric » R32sfcpu Firmware
Versions up to, including, (<=) 22
cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R32sfcpu » Version: N/A
Mitsubishielectric » R120sfcpu Firmware
Versions up to, including, (<=) 22
cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R120sfcpu » Version: N/A
Mitsubishielectric » R08pcpu Firmware
Versions up to, including, (<=) 25
cpe:2.3:o:mitsubishielectric:r08pcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R08pcpu » Version: N/A
Mitsubishielectric » R16pcpu Firmware
Versions up to, including, (<=) 25
cpe:2.3:o:mitsubishielectric:r16pcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R16pcpu » Version: N/A
Mitsubishielectric » R32pcpu Firmware
Versions up to, including, (<=) 25
cpe:2.3:o:mitsubishielectric:r32pcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R32pcpu » Version: N/A
Mitsubishielectric » R120pcpu Firmware
Versions up to, including, (<=) 25
cpe:2.3:o:mitsubishielectric:r120pcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R120pcpu » Version: N/A
Mitsubishielectric » R08psfcpu Firmware
Versions up to, including, (<=) 06
cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R08psfcpu » Version: N/A
Mitsubishielectric » R16psfcpu Firmware
Versions up to, including, (<=) 06
cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R16psfcpu » Version: N/A
Mitsubishielectric » R32psfcpu Firmware
Versions up to, including, (<=) 06
cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R32psfcpu » Version: N/A
Mitsubishielectric » R120psfcpu Firmware
Versions up to, including, (<=) 06
cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » R120psfcpu » Version: N/A
Mitsubishielectric » Rj71gf11-t2 Firmware
Versions up to, including, (<=) 47
cpe:2.3:o:mitsubishielectric:rj71gf11-t2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Rj71gf11-t2 » Version: N/A
Mitsubishielectric » Rj72gf15-t2 Firmware
Versions up to, including, (<=) 07
cpe:2.3:o:mitsubishielectric:rj72gf15-t2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Rj72gf15-t2 » Version: N/A
Mitsubishielectric » Rj71gp21-sx Firmware
Versions up to, including, (<=) 47
cpe:2.3:o:mitsubishielectric:rj71gp21-sx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Rj71gp21-sx » Version: N/A
Mitsubishielectric » Rj71gp21s-sx Firmware
Versions up to, including, (<=) 47
cpe:2.3:o:mitsubishielectric:rj71gp21s-sx_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Rj71gp21s-sx » Version: N/A
Mitsubishielectric » Rj71c24-r2 Firmware
Versions up to, including, (<=) 47
cpe:2.3:o:mitsubishielectric:rj71c24-r2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Rj71c24-r2 » Version: N/A
Mitsubishielectric » Rj71c24-r4 Firmware
Versions up to, including, (<=) 47
cpe:2.3:o:mitsubishielectric:rj71c24-r4_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Mitsubishielectric » Rj71c24-r4 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-5668

EPSS FAQ

1.72%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 88 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-5668

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2020-5668

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-5668

https://us-cert.cisa.gov/ics/advisories/icsa-20-324-05

Mitsubishi Electric MELSEC iQ-R Series | CISA
Third Party Advisory;US Government Resource
https://jvn.jp/vu/JVNVU95980140/index.html

JVNVU#95980140: 三菱電機製 MELSEC iQ-R シリーズにおけるリソース枯渇の脆弱性
Third Party Advisory
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-016.pdf

Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-016_en.pdf

MITSUBISHI ELECTRIC Global website
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-5668

Products affected by CVE-2020-5668

Exploit prediction scoring system (EPSS) score for CVE-2020-5668

CVSS scores for CVE-2020-5668

CWE ids for CVE-2020-5668

References for CVE-2020-5668