VulnerabilityModified
CVE-2020-16226
Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands.
CRITICAL 9.8EPSS 2.27%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.27% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-342
- Affected
- mitsubishielectric/qj71mes96 firmware · mitsubishielectric/qj71ws96 firmware · mitsubishielectric/q06ccpu-v firmware · mitsubishielectric/q24dhccpu-v firmware · mitsubishielectric/q24dhccpu-vg firmware · mitsubishielectric/r12ccpu-v firmware · mitsubishielectric/rd55up06-v firmware · mitsubishielectric/rd55up12-v firmware · mitsubishielectric/rj71gn11-t2 firmware · mitsubishielectric/rj71en71 firmware · mitsubishielectric/qj71e71-100 firmware · mitsubishielectric/lj71e71-100 firmware · mitsubishielectric/qj71mt91 firmware · mitsubishielectric/rd78gn\(n\=4\,8\,16\,32\,64\) firmware · mitsubishielectric/rd78ghv firmware · mitsubishielectric/rd78ghw firmware · mitsubishielectric/nz2gacp620-60 firmware · mitsubishielectric/nz2gacp620-300 firmware · mitsubishielectric/nz2ft-mt firmware · mitsubishielectric/nz2ft-eip firmware · +40 more
- Source
- ics-cert@hq.dhs.gov
References
- https://us-cert.cisa.gov/ics/advisories/icsa-20-245-01Third Party Advisory, US Government Resource
- https://us-cert.cisa.gov/ics/advisories/icsa-20-245-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.