CVE-2020-13238
High
Description
Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time. After halting, physical access to the PLC is required in order to restore production.
SeverityHigh
CVSS7.5
Exploit probability—
ProductMitsubishielectric Melsec Iq-r00cpu Firmware
PublishedJun 10, 2020
First seenJun 10, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mitsubishielectric melsec_iq-r00cpu_firmware | v ≤ 7 | — |
| mitsubishielectric melsec_iq-r01cpu_firmware | v ≤ 7 | — |
| mitsubishielectric melsec_iq-r02cpu_firmware | v ≤ 7 | — |
| mitsubishielectric melsec_iq-r04cpu_firmware | v ≤ 39 | — |
| mitsubishielectric melsec_iq-r08cpu_firmware | v ≤ 39 | — |
| mitsubishielectric melsec_iq-r16cpu_firmware | v ≤ 39 | — |
| mitsubishielectric melsec_iq-r32cpu_firmware | v ≤ 39 | — |
| mitsubishielectric melsec_iq-r120cpu_firmware | v ≤ 39 | — |
| mitsubishielectric melsec_iq-r08fcpu_firmware | v ≤ 20 | — |
| mitsubishielectric melsec_iq-r16fcpu_firmware | v ≤ 20 | — |
| mitsubishielectric melsec_iq-r32fcpu_firmware | v ≤ 20 | — |
| mitsubishielectric melsec_iq-r120fcpu_firmware | v ≤ 20 | — |
| mitsubishielectric melsec_iq-r08pcpu_firmware | No range specified | — |
| mitsubishielectric melsec_iq-r16pcpu_firmware | No range specified | — |
| mitsubishielectric melsec_iq-r32pcpu_firmware | No range specified | — |
| mitsubishielectric melsec_iq-r120pcpu_firmware | No range specified | — |
| mitsubishielectric melsec_iq-r08sfcpu_firmware | No range specified | — |
| mitsubishielectric melsec_iq-r16sfcpu_firmware | No range specified | — |
| mitsubishielectric melsec_iq-r32sfcpu_firmware | No range specified | — |
| mitsubishielectric melsec_iq-r120sfcpu_firmware | No range specified | — |
| mitsubishielectric melsec_iq-rj71en71_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.