Lucene search

[email protected]CVE-2020-13238

HistoryJun 10, 2020 - 8:15 p.m.

CVE-2020-13238

2020-06-1020:15:14

CWE-400

[email protected]

web.nvd.nist.gov

cve-2020-13238

mitsubishi

melsec

iq-r series

plcs

firmware 33

denial of service

unauthenticated

crafted packet

industrial process

excessive cpu time

physical access

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.003 Low

EPSS

Percentile

70.2%

JSON

Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time. After halting, physical access to the PLC is required in order to restore production.

Affected configurations

NVD

Node

mitsubishielectricmelsec_iq-r00cpuMatch-

AND

mitsubishielectricmelsec_iq-r00cpu_firmwareRange≤7

Node

mitsubishielectricmelsec_iq-r01cpuMatch-

AND

mitsubishielectricmelsec_iq-r01cpu_firmwareRange≤7

Node

mitsubishielectricmelsec_iq-r02cpuMatch-

AND

mitsubishielectricmelsec_iq-r02cpu_firmwareRange≤7

Node

mitsubishielectricmelsec_iq-r04cpuMatch-

AND

mitsubishielectricmelsec_iq-r04cpu_firmwareRange≤39

Node

mitsubishielectricmelsec_iq-r08cpuMatch-

AND

mitsubishielectricmelsec_iq-r08cpu_firmwareRange≤39

Node

mitsubishielectricmelsec_iq-r16cpuMatch-

AND

mitsubishielectricmelsec_iq-r16cpu_firmwareRange≤39

Node

mitsubishielectricmelsec_iq-r32cpuMatch-

AND

mitsubishielectricmelsec_iq-r32cpu_firmwareRange≤39

Node

mitsubishielectricmelsec_iq-r120cpuMatch-

AND

mitsubishielectricmelsec_iq-r120cpu_firmwareRange≤39

Node

mitsubishielectricmelsec_iq-r08fcpu_firmwareRange≤20

AND

mitsubishielectricmelsec_iq-r08fcpuMatch-

Node

mitsubishielectricmelsec_iq-r16fcpu_firmwareRange≤20

AND

mitsubishielectricmelsec_iq-r16fcpuMatch-

Node

mitsubishielectricmelsec_iq-r32fcpu_firmwareRange≤20

AND

mitsubishielectricmelsec_iq-r32fcpuMatch-

Node

mitsubishielectricmelsec_iq-r120fcpu_firmwareRange≤20

AND

mitsubishielectricmelsec_iq-r120fcpuMatch-

Node

mitsubishielectricmelsec_iq-r08pcpu_firmware

AND

mitsubishielectricmelsec_iq-r08pcpuMatch-

Node

mitsubishielectricmelsec_iq-r16pcpu_firmware

AND

mitsubishielectricmelsec_iq-r16pcpuMatch-

Node

mitsubishielectricmelsec_iq-r32pcpu_firmware

AND

mitsubishielectricmelsec_iq-r32pcpuMatch-

Node

mitsubishielectricmelsec_iq-r120pcpu_firmware

AND

mitsubishielectricmelsec_iq-r120pcpuMatch-

Node

mitsubishielectricmelsec_iq-r08sfcpu_firmware

AND

mitsubishielectricmelsec_iq-r08sfcpuMatch-

Node

mitsubishielectricmelsec_iq-r16sfcpu_firmware

AND

mitsubishielectricmelsec_iq-r16sfcpuMatch-

Node

mitsubishielectricmelsec_iq-r32sfcpu_firmware

AND

mitsubishielectricmelsec_iq-r32sfcpuMatch-

Node

mitsubishielectricmelsec_iq-r120sfcpu_firmware

AND

mitsubishielectricmelsec_iq-r120sfcpuMatch-

Node

mitsubishielectricmelsec_iq-rj71en71_firmware

AND

mitsubishielectricmelsec_iq-rj71en71Match-

CPENameOperatorVersion
mitsubishielectric:melsec_iq-r00cpu_firmwaremitsubishielectric melsec iq-r00cpu firmwarele7

CPE	Name	Operator	Version
mitsubishielectric:melsec_iq-r00cpu_firmware	mitsubishielectric melsec iq-r00cpu firmware	le	7

References

jvn.jp/vu/JVNVU97662844/index.html

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-001_en.pdf

www.us-cert.gov/ics/advisories/icsa-20-161-02

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.3 High

AI Score

Confidence

High

7.8 High

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.003 Low

EPSS

Percentile

70.2%

JSON

Related for CVE-2020-13238

cvelist1 nvd1 nessus1 ics1 prion1