PT-2020-18623 · Mitsubishi · Rj71Eip91+5

Published 2020-10-30 · Updated 2020-11-10 · CVE-2020-5656

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MELSEC iQ-R series versions with the following modules: RJ71EIP91 EtherNet/IP Network Interface Module with serial number starting with '02' or before RJ71PN92 PROFINET IO Controller Module with serial number starting with '01' or before RD81DL96 High Speed Data Logger Module with serial number starting with '08' or before RD81MES96N MES Interface Module with serial number starting with '04' or before RD81OPC96 OPC UA Server Module with serial number starting with '04' or before

Description The issue is related to improper access control in the TCP/IP function of the affected modules, allowing a remote unauthenticated attacker to send a specially crafted packet. This can lead to the network functions of the products being stopped or the execution of a malicious program.

Recommendations For RJ71EIP91 EtherNet/IP Network Interface Module with serial number starting with '02' or before, consider restricting access to the module until a fix is available. For RJ71PN92 PROFINET IO Controller Module with serial number starting with '01' or before, restrict network access to the module to minimize the risk of exploitation. For RD81DL96 High Speed Data Logger Module with serial number starting with '08' or before, avoid using the module in a networked environment until the issue is resolved. For RD81MES96N MES Interface Module with serial number starting with '04' or before, and RD81OPC96 OPC UA Server Module with serial number starting with '04' or before, limit the use of these modules in sensitive networks until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-5656

Affected Products

Melsec Iq-R Series

Rd81Dl96

Rd81Mes96N

Rd81Opc96

Rj71Eip91

Rj71Pn92

References · 4

• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf · Vendor Advisory
• https://mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5656 · Security Note
• https://jvn.jp/vu/JVNVU92513419/index.html · Note