PT-2019-12117 · Mitsubishi · Melsec-Q Series Ethernet Module Qj71E71-100

Published 2019-05-23 · Updated 2020-10-02 · CVE-2019-10977

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric MELSEC-Q series Ethernet module QJ71E71-100 versions with serial number 20121 and prior

Description The issue allows an attacker to send crafted TCP packets against the "FTP service", forcing the target devices to enter an error mode and cause a denial-of-service condition.

Recommendations For versions with serial number 20121 and prior, consider disabling the FTP service as a temporary workaround until a patch is available. Restrict access to the Ethernet module to minimize the risk of exploitation.

Fix

Improper Handling of Exceptional Conditions

Resource Exhaustion

Weakness Enumeration

CWE-755

CWE-400

Related Identifiers

CVE-2019-10977

Affected Products

Melsec-Q Series Ethernet Module Qj71E71-100

References · 4

• https://osv.dev/vulnerability/CVE-2019-10977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10977 · Security Note
• http://securityfocus.com/bid/108419 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-19-141-02 · Note