CVE-2020-5527
As a result, it may fall into a denial-of-service (DoS) condition.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource consumption occurs and the port does not process the data properly. As a result, it may fall into a denial-of-service (DoS) condition. The vendor states this vulnerability only affects Ethernet communication functions.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.36% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- mitsubishielectric/cr800-q firmware · mitsubishielectric/fx3g firmware · mitsubishielectric/fx3gc firmware · mitsubishielectric/fx3s firmware · mitsubishielectric/fx3u firmware · mitsubishielectric/fx3uc firmware · mitsubishielectric/fx5u firmware · mitsubishielectric/fx5uc firmware · mitsubishielectric/fx5uj firmware · mitsubishielectric/l02cpu firmware · mitsubishielectric/l02cpu-p firmware · mitsubishielectric/l02scpu firmware · mitsubishielectric/l02scpu-p firmware · mitsubishielectric/l06cpu firmware · mitsubishielectric/l06cpu-p firmware · mitsubishielectric/l26cpu firmware · mitsubishielectric/l26cpu-bt firmware · mitsubishielectric/l26cpu-p firmware · mitsubishielectric/l26cpu-pbt firmware · mitsubishielectric/q02phcpu firmware · +26 more
- Source
- vultures@jpcert.or.jp
References
- https://jvn.jp/en/vu/JVNVU91553662/index.htmlThird Party Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2019-005_en.pdfVendor Advisory
- https://jvn.jp/en/vu/JVNVU91553662/index.htmlThird Party Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2019-005_en.pdfVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.