Vulnerability · Published Feb 17, 2020 · Assigned by jpcert
CVE-2020-5531
Critical 9.8
In plain English
A critical-severity security flaw in Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Official description
Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User Ethernet port (CH1, CH2): First 5 digits of serial number 21121 or before), MELSEC iQ-R Series C Controller Module / C Intelligent Function Module(R12CCPU-V Ethernet port (CH1, CH2): First 2 digits of serial number 11 or before, and RD55UP06-V Ethernet port: First 2 digits of serial number 08 or before), and MELIPC Series MI5000(MI5122-VW Ethernet port (CH1): First 2 digits of serial number 03 or before, or the firmware version 03 or before) allow remote attackers to cause a denial of service and/or malware being executed via unspecified vectors.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mitsubishi Electric Corporation | Mitsubishi Electric MELSEC C Controller Module and MELIPC Series MI5000 | MELSEC-Q Series C Controller Module(Q24DHCCPU-V, Q24DHCCPU-VG User Ethernet port (CH1, CH2): First 5 digits of serial number 21121 or before), MELSEC iQ-R Series C Controller Module / C Intelligent Function Module(R12CCPU-V Ethernet port (CH1, CH2): First 2 digits of serial number 11 or before, and RD55UP06-V Ethernet port: First 2 digits of serial number 08 or before), and MELIPC Series MI5000(MI5122-VW Ethernet port (CH1): First 2 digits of serial number 03 or before, or the firmware version 03 or before) |
References
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2019-003_en.pdf x_refsource_MISC
- https://jvn.jp/en/vu/JVNVU95424547/index.html x_refsource_MISC