Log in Start free

Vulnerability · Published Mar 30, 2020 · Assigned by jpcert

CVE-2020-5527

High 7.5

In plain English

A high-severity security flaw in MELSOFT transmission port (UDP/IP) of multiple Mitsubishi Electric MELSEC series from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.4%top 28.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource consumption occurs and the port does not process the data properly. As a result, it may fall into a denial-of-service (DoS) condition. The vendor states this vulnerability only affects Ethernet communication functions.

Affected products (as reported)

VendorProductVersions
Mitsubishi Electric Corporation MELSOFT transmission port (UDP/IP) of multiple Mitsubishi Electric MELSEC series MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions)

References