CVEvulnerability

CVE-2020-16850

7.5 HIGH Published 2020-11-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-11-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-20, CWE-400

Description

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2.

Affected configurations

• mitsubishielectric r00cpu firmware (<= 20) • mitsubishielectric r01cpu firmware (<= 20) • mitsubishielectric r02cpu firmware (<= 20) • mitsubishielectric r04cpu firmware (<= 52) • mitsubishielectric r08cpu firmware (<= 52) • mitsubishielectric r16cpu firmware (<= 52) • mitsubishielectric r32cpu firmware (<= 52) • mitsubishielectric r120cpu firmware (<= 52) • mitsubishielectric r08sfcpu firmware (<= 22) • mitsubishielectric r16sfcpu firmware (<= 22) • mitsubishielectric r32sfcpu firmware (<= 22) • mitsubishielectric r120sfcpu firmware (<= 22) • mitsubishielectric r08pcpu firmware • mitsubishielectric r16pcpu firmware • mitsubishielectric r32pcpu firmware • mitsubishielectric r120pcpu firmware • mitsubishielectric r16mtcpu firmware • mitsubishielectric r32mtcpu firmware • mitsubishielectric r64mtcpu firmware

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References