PT-2020-13388 · Mitsubishi · Melsec Iq-R Series Plcs

Published 2020-06-10 · Updated 2020-06-23 · CVE-2020-13238

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mitsubishi MELSEC iQ-R Series PLCs version 33

Description The issue allows attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, consuming excessive CPU time and resulting in a denial of service attack. After the process is halted, physical access to the PLC is required to restore production.

Recommendations For Mitsubishi MELSEC iQ-R Series PLCs version 33, consider restricting network access to the PLC to minimize the risk of exploitation, and ensure that physical access controls are in place to facilitate restoration of production in case of an attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-13238

Affected Products

Melsec Iq-R Series Plcs

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-13238 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13238 · Vendor Advisory
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-001_en.pdf · Vendor Advisory
• http://jvn.jp/vu/JVNVU97662844/index.html · Note
• https://us-cert.gov/ics/advisories/icsa-20-161-02 · Note