PT-2020-18572 · Mitsubishi · Mitsubishi Electric Got2000 Series+1

Published 2020-07-07 · Updated 2021-07-21 · CVE-2020-5599

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model)

Description The issue is related to an improper neutralization of argument delimiters in a command, also known as 'Argument Injection', which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.

Recommendations For Mitsubishi Electric GOT2000 series with CoreOS version -Y and earlier, consider disabling the TCP/IP function temporarily until a patch is available to prevent potential exploitation. Restrict access to the network to minimize the risk of a remote attacker stopping the network functions or executing malicious programs.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2020-5599

Affected Products

Corebos

Mitsubishi Electric Got2000 Series

References · 5

• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-005_en.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5599 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5599 · Security Note
• https://jvn.jp/en/vu/JVNVU95413676/index.html · Note
• https://t.me/cvenotify/4900 · Telegram Post