Vulnerability · Published Nov 6, 2020 · Assigned by jpcert

CVE-2020-5649

High 7.5

In plain English

A high-severity security flaw in GT14 Model of GOT 1000 series from Mitsubishi Electric Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.1% (higher than 91% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)4.1%top 9.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric Corporation	GT14 Model of GOT 1000 series	(GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier)

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-310-02 x_refsource_MISC
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-014_en.pdf x_refsource_MISC
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-014.pdf x_refsource_MISC
https://jvn.jp/vu/JVNVU99562395/index.html x_refsource_MISC