Vulnerability Description
Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/120 (EN) CPU firmware version '51' and earlier, R08/16/32/120SFCPU firmware version '22' and earlier, R08/16/32/120PCPU firmware version '25' and earlier, R08/16/32/120PSFCPU firmware version '06' and earlier, RJ71EN71 firmware version '47' and earlier, RJ71GF11-T2 firmware version '47' and earlier, RJ72GF15-T2 firmware version '07' and earlier, RJ71GP21-SX firmware version '47' and earlier, RJ71GP21S-SX firmware version '47' and earlier, and RJ71GN11-T2 firmware version '11' and earlier) allows a remote unauthenticated attacker to cause an error in a CPU unit and cause a denial-of-service (DoS) condition in execution of the program and its communication, or to cause a denial-of-service (DoS) condition in communication via the unit by receiving a specially crafted SLMP packet
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mitsubishielectric | R00Cpu Firmware | <= 19 |
| Mitsubishielectric | R00Cpu | - |
| Mitsubishielectric | R01Cpu Firmware | <= 19 |
| Mitsubishielectric | R01Cpu | - |
| Mitsubishielectric | R02Cpu Firmware | <= 19 |
| Mitsubishielectric | R02Cpu | - |
| Mitsubishielectric | R04Cpu Firmware | <= 51 |
| Mitsubishielectric | R04Cpu | - |
| Mitsubishielectric | R08Cpu Firmware | <= 51 |
| Mitsubishielectric | R08Cpu | - |
| Mitsubishielectric | R16Cpu Firmware | <= 51 |
| Mitsubishielectric | R16Cpu | - |
| Mitsubishielectric | R32Cpu Firmware | <= 51 |
| Mitsubishielectric | R32Cpu | - |
| Mitsubishielectric | R120Cpu Firmware | <= 51 |
| Mitsubishielectric | R120Cpu | - |
| Mitsubishielectric | R08Sfcpu Firmware | <= 22 |
| Mitsubishielectric | R08Sfcpu | - |
| Mitsubishielectric | R16Sfcpu Firmware | <= 22 |
| Mitsubishielectric | R16Sfcpu | - |
Related Weaknesses (CWE)
References
- https://jvn.jp/vu/JVNVU95980140/index.htmlThird Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-20-324-05Third Party AdvisoryUS Government Resource
- https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-016.pdfVendor Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-016_en.pdfVendor Advisory
- https://jvn.jp/vu/JVNVU95980140/index.htmlThird Party Advisory
- https://us-cert.cisa.gov/ics/advisories/icsa-20-324-05Third Party AdvisoryUS Government Resource
- https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-016.pdfVendor Advisory
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-016_en.pdfVendor Advisory
FAQ
What is CVE-2020-5668?
CVE-2020-5668 is a vulnerability with a CVSS score of 7.5 (HIGH). Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series modules (R00/01/02CPU firmware version '19' and earlier, R04/08/16/32/120 (EN) CPU firmware version '51' and earlier, R08/16/32/12...
How severe is CVE-2020-5668?
CVE-2020-5668 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-5668?
Check the references section above for vendor advisories and patch information. Affected products include: Mitsubishielectric R00Cpu Firmware, Mitsubishielectric R00Cpu, Mitsubishielectric R01Cpu Firmware, Mitsubishielectric R01Cpu, Mitsubishielectric R02Cpu Firmware.