Resource exhaustion in Mitsubishielectric Melsec Iq-R00cpu
CVE-2020-13238
Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time. After halting, physical access to the PLC is required in order to restore production.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.033 (87.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Mitsubishielectric Melsec_iq-r00cpu
- Mitsubishielectric Melsec_iq-r00cpu_firmware
- Mitsubishielectric Melsec_iq-r01cpu
- Mitsubishielectric Melsec_iq-r01cpu_firmware
- Mitsubishielectric Melsec_iq-r02cpu
- Mitsubishielectric Melsec_iq-r02cpu_firmware
- Mitsubishielectric Melsec_iq-r04cpu
- Mitsubishielectric Melsec_iq-r04cpu_firmware
- Mitsubishielectric Melsec_iq-r08cpu
- Mitsubishielectric Melsec_iq-r08cpu_firmware
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-13238?
- CVE-2020-13238 is a high-severity vulnerability in Mitsubishielectric Melsec Iq-R00cpu, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2020-06-10.
- How severe is CVE-2020-13238?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2020-13238 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.