PT-2020-18625 · Mitsubishi · Rj71Eip91+5

Published 2020-10-30 · Updated 2021-07-21 · CVE-2020-5658

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions MELSEC iQ-R series versions with the following modules and serial numbers: RJ71EIP91 EtherNet/IP Network Interface Module with serial number starting with '02' or before RJ71PN92 PROFINET IO Controller Module with serial number starting with '01' or before RD81DL96 High Speed Data Logger Module with serial number starting with '08' or before RD81MES96N MES Interface Module with serial number starting with '04' or before RD81OPC96 OPC UA Server Module with serial number starting with '04' or before

Description A Resource Management Errors issue in the TCP/IP function of the MELSEC iQ-R series firmware allows a remote unauthenticated attacker to stop the network functions of the products by sending a specially crafted packet.

Recommendations For RJ71EIP91 EtherNet/IP Network Interface Module with serial number starting with '02' or before, consider disabling the network functions until a patch is available. For RJ71PN92 PROFINET IO Controller Module with serial number starting with '01' or before, restrict access to the module to minimize the risk of exploitation. For RD81DL96 High Speed Data Logger Module with serial number starting with '08' or before, avoid using the module for critical operations until the issue is resolved. For RD81MES96N MES Interface Module with serial number starting with '04' or before, consider implementing additional security measures to prevent unauthorized access. For RD81OPC96 OPC UA Server Module with serial number starting with '04' or before, restrict access to the module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-5658

Affected Products

Melsec Iq-R Series

Rd81Dl96

Rd81Mes96N

Rd81Opc96

Rj71Eip91

Rj71Pn92

References · 4

• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5658 · Security Note
• https://mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf · Vendor Advisory
• https://jvn.jp/vu/JVNVU92513419/index.html · Note