Uncontrolled Resource Consumption in Mitsubishi Electric Ethernet Port on MELSEC iQ-R and other CPU Modules
CVE-2020-5652

7.5HIGH

Key Information:

Vendor: Mitsubishi Electric Corporation
Status: Melsec Iq-r, Q And L Series
Vendor: CVE Published:; 2 November 2020

Summary

A vulnerability exists in the Ethernet communication functions of the MELSEC iQ-R, Q, and L series CPU modules from Mitsubishi Electric. This vulnerability allows a remote, unauthenticated attacker to disrupt Ethernet communication by sending specially crafted packets, which can result in a denial of service (DoS) condition. Devices operating with specific firmware versions are particularly susceptible, making it crucial for users to assess and update their systems to mitigate potential risks.

Affected Version(s)

MELSEC iQ-R, Q and L series R 00/01/02 CPU firmware versions '20' and earlier, R 04/08/16/32/120 (EN) CPU firmware versions '52' and earlier, R 08/16/32/120 SFCPU firmware versions '22' and earlier, R 08/16/32/120 PCPU all versions, R 08/16/32/120 PSFCPU all versions, R 16/32/64 MTCPU all versions, Q03 UDECPU, Q 04/06/10/13/20/26/50/100 UDEHCPU serial number '22081' and earlier, Q 03/04/06/13/26 UDVCPU serial number '22031' and earlier, Q 04/06/13/26 UDPVCPU serial number '22031' and earlier, Q 172/173 DCPU all versions, Q 172/173 DSCPU all versions, Q 170 MCPU all versions, Q 170 MSCPU all versions, and L 02/06/26 CPU (-P) and L 26 CPU - (P) BT all versions