PT-2020-5562 · Mitsubishi · Melsec Iq-R Series Plcs

Published 2020-11-30 · Updated 2021-07-21 · CVE-2020-16850

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mitsubishi MELSEC iQ-R Series PLCs version 49

Description The issue allows an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network, exposing Improper Input Validation. This results in a denial of service attack. After the process is halted, physical access to the PLC is required to restore production, and the device state is lost. The issue is related to specific models including R04CPU and RJ71GF11-T2.

Recommendations For Mitsubishi MELSEC iQ-R Series PLCs version 49, consider implementing network segmentation to restrict access to the PLC and limit the potential impact of a denial of service attack. As a temporary workaround, restrict network access to the PLC to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

BDU:2021-01161

CVE-2020-16850

Affected Products

Melsec Iq-R Series Plcs

References · 7

• https://bdu.fstec.ru/vul/2021-01161 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-16850 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16850 · Vendor Advisory
• https://t.me/cibsecurity/16956 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-282-02 · Note
• https://blog.scadafence.com/vulnerability-in-mitsubishi-electric-melsec-iq-r-series · Note
• https://us-cert.gov/ics/advisories/icsa-20-282-02 · Note