CVE-2020-13238
Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time. After halting, physical access to the PLC is required in order to restore production.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 3.34% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- mitsubishielectric/melsec iq-r00cpu firmware · mitsubishielectric/melsec iq-r01cpu firmware · mitsubishielectric/melsec iq-r02cpu firmware · mitsubishielectric/melsec iq-r04cpu firmware · mitsubishielectric/melsec iq-r08cpu firmware · mitsubishielectric/melsec iq-r16cpu firmware · mitsubishielectric/melsec iq-r32cpu firmware · mitsubishielectric/melsec iq-r120cpu firmware · mitsubishielectric/melsec iq-r08fcpu firmware · mitsubishielectric/melsec iq-r16fcpu firmware · mitsubishielectric/melsec iq-r32fcpu firmware · mitsubishielectric/melsec iq-r120fcpu firmware · mitsubishielectric/melsec iq-r08pcpu firmware · mitsubishielectric/melsec iq-r16pcpu firmware · mitsubishielectric/melsec iq-r32pcpu firmware · mitsubishielectric/melsec iq-r120pcpu firmware · mitsubishielectric/melsec iq-r08sfcpu firmware · mitsubishielectric/melsec iq-r16sfcpu firmware · mitsubishielectric/melsec iq-r32sfcpu firmware · mitsubishielectric/melsec iq-r120sfcpu firmware · +1 more
- Source
- cve@mitre.org
References
- http://jvn.jp/vu/JVNVU97662844/index.htmlThird Party Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-001_en.pdfVendor Advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-161-02Third Party Advisory, US Government Resource
- http://jvn.jp/vu/JVNVU97662844/index.htmlThird Party Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-001_en.pdfVendor Advisory
- https://www.us-cert.gov/ics/advisories/icsa-20-161-02Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.