PT-2020-18619 · Mitsubishi · Melsec Iq-R R 16/32/64 Mtcpu+11

Published

2020-10-30

·

Updated

2024-09-14

·

CVE-2020-5652

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions MELSEC iQ-R series CPU modules versions '20' and earlier MELSEC Q series CPU modules versions '52' and earlier MELSEC L series CPU modules versions with serial number '22081' and earlier MELSEC iQ-R R 04/08/16/32/120 (EN) CPU firmware versions '52' and earlier MELSEC iQ-R R 08/16/32/120 SFCPU firmware versions '22' and earlier MELSEC iQ-R R 08/16/32/120 PCPU all versions MELSEC iQ-R R 08/16/32/120 PSFCPU all versions MELSEC iQ-R R 16/32/64 MTCPU all versions MELSEC Q03 UDECPU all versions MELSEC Q 04/06/10/13/20/26/50/100 UDEHCPU serial number '22081' and earlier MELSEC Q 03/04/06/13/26 UDVCPU serial number '22031' and earlier MELSEC Q 04/06/13/26 UDPVCPU serial number '22031' and earlier MELSEC Q 172/173 DCPU all versions MELSEC Q 172/173 DSCPU all versions MELSEC Q 170 MCPU all versions MELSEC Q 170 MSCPU all versions MELSEC L 02/06/26 CPU (-P) and L 26 CPU - (P) BT all versions
Description The issue is related to an uncontrolled resource consumption vulnerability in the Ethernet Port on MELSEC iQ-R, Q, and L series CPU modules. This vulnerability allows a remote unauthenticated attacker to stop the Ethernet communication functions of the products via a specially crafted packet, which may lead to a denial of service (DoS) condition.
Recommendations For MELSEC iQ-R series CPU modules versions '20' and earlier, update the firmware to a version later than '20'. For MELSEC Q series CPU modules versions '52' and earlier, update the firmware to a version later than '52'. For MELSEC L series CPU modules versions with serial number '22081' and earlier, update the firmware to a version later than the one with serial number '22081'. For MELSEC iQ-R R 04/08/16/32/120 (EN) CPU firmware versions '52' and earlier, update the firmware to a version later than '52'. For MELSEC iQ-R R 08/16/32/120 SFCPU firmware versions '22' and earlier, update the firmware to a version later than '22'. For MELSEC iQ-R R 08/16/32/120 PCPU all versions, restrict access to the Ethernet Port until a patch is available. For MELSEC iQ-R R 08/16/32/120 PSFCPU all versions, restrict access to the Ethernet Port until a patch is available. For MELSEC iQ-R R 16/32/64 MTCPU all versions, restrict access to the Ethernet Port until a patch is available. For MELSEC Q03 UDECPU all versions, restrict access to the Ethernet Port until a patch is available. For MELSEC Q 04/06/10/13/20/26/50/100 UDEHCPU serial number '22081' and earlier, update the firmware to a version later than the one with serial number '22081'. For MELSEC Q 03/04/06/13/26 UDVCPU serial number '22031' and earlier, update the firmware to a version later than the one with serial number '22031'. For MELSEC Q 04/06/13/26 UDPVCPU serial number '22031' and earlier, update the firmware to a version later than the one with serial number '22031'. For MELSEC Q 172/173 DCPU all versions, restrict access to the Ethernet Port until a patch is available. For MELSEC Q 172/173 DSCPU all versions, restrict access to the Ethernet Port until a patch is available. For MELSEC Q 170 MCPU all versions, restrict access to the Ethernet Port until a patch is available. For MELSEC Q 170 MSCPU all versions, restrict access to the Ethernet Port until a patch is available. For MELSEC L 02/06/26 CPU (-P) and L 26 CPU - (P) BT all versions, restrict access to the Ethernet Port until a patch is available.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2020-5652

Affected Products

Melsec L 02/06/26 Cpu
Melsec-F Series Cpu Modules
Melsec Q 03/04/06/13/26 Udvcpu
Melsec Q Series Q04/06/10/13/20/26/50/100Udehcpu
Melsec Q 04/06/13/26 Udpvcpu
Melsec Q 170 Mcpu
Melsec Q 172/173 Dcpu
Melsec Iq-R Series Cpu Modules
Melsec Q03 Udecpu
Melsec Iq-R Series R04/08/16/32/120(En)Cpu
Melsec Iq-R R 08/16/32/120 Pcpu
Melsec Iq-R R 16/32/64 Mtcpu