CVE-2020-16850
High
Description
Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2.
SeverityHigh
CVSS7.5
Exploit probability—
ProductMitsubishielectric R04cpu Firmware
PublishedNov 30, 2020
First seenNov 30, 2020
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mitsubishielectric r04cpu_firmware | v ≤ 52 | — |
| mitsubishielectric r00cpu_firmware | v ≤ 20 | — |
| mitsubishielectric r01cpu_firmware | v ≤ 20 | — |
| mitsubishielectric r02cpu_firmware | v ≤ 20 | — |
| mitsubishielectric r08cpu_firmware | v ≤ 52 | — |
| mitsubishielectric r16cpu_firmware | v ≤ 52 | — |
| mitsubishielectric r32cpu_firmware | v ≤ 52 | — |
| mitsubishielectric r120cpu_firmware | v ≤ 52 | — |
| mitsubishielectric r08sfcpu_firmware | v ≤ 22 | — |
| mitsubishielectric r16sfcpu_firmware | v ≤ 22 | — |
| mitsubishielectric r32sfcpu_firmware | v ≤ 22 | — |
| mitsubishielectric r120sfcpu_firmware | v ≤ 22 | — |
| mitsubishielectric r08pcpu_firmware | No range specified | — |
| mitsubishielectric r16pcpu_firmware | No range specified | — |
| mitsubishielectric r32pcpu_firmware | No range specified | — |
| mitsubishielectric r120pcpu_firmware | No range specified | — |
| mitsubishielectric r16mtcpu_firmware | No range specified | — |
| mitsubishielectric r32mtcpu_firmware | No range specified | — |
| mitsubishielectric r64mtcpu_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.