CVE-2020-5666 (GCVE-0-2020-5666)

Vulnerability from cvelistv5 – Published: 2020-11-16 00:49 – Updated: 2024-08-04 08:39
VLAI
Summary
Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51') allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
  • Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51') allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.
Assigner
References
Impacted products
Vendor Product Version CPE status
Mitsubishi Electric Corporation MELSEC iQ-R Series CPU Modules Affected: R00/01/02CPU Firmware versions from '05' to '19' and R04/08/16/32/120(EN)CPU Firmware versions from '35' to '51'
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:39:25.681Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/jp/JVN44764844/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN44764844/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MELSEC iQ-R Series CPU Modules",
          "vendor": "Mitsubishi Electric Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "R00/01/02CPU Firmware versions from \u002705\u0027 to \u002719\u0027 and R04/08/16/32/120(EN)CPU Firmware versions from \u002735\u0027 to \u002751\u0027"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from \u002705\u0027 to \u002719\u0027 and R04/08/16/32/120(EN)CPU Firmware versions from \u002735\u0027 to \u002751\u0027) allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from \u002705\u0027 to \u002719\u0027 and R04/08/16/32/120(EN)CPU Firmware versions from \u002735\u0027 to \u002751\u0027) allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-16T00:49:54.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/jp/JVN44764844/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN44764844/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2020-5666",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MELSEC iQ-R Series CPU Modules",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "R00/01/02CPU Firmware versions from \u002705\u0027 to \u002719\u0027 and R04/08/16/32/120(EN)CPU Firmware versions from \u002735\u0027 to \u002751\u0027"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mitsubishi Electric Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from \u002705\u0027 to \u002719\u0027 and R04/08/16/32/120(EN)CPU Firmware versions from \u002735\u0027 to \u002751\u0027) allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from \u002705\u0027 to \u002719\u0027 and R04/08/16/32/120(EN)CPU Firmware versions from \u002735\u0027 to \u002751\u0027) allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf",
              "refsource": "MISC",
              "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf"
            },
            {
              "name": "https://jvn.jp/jp/JVN44764844/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/jp/JVN44764844/index.html"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN44764844/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN44764844/index.html"
            },
            {
              "name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01",
              "refsource": "MISC",
              "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2020-5666",
    "datePublished": "2020-11-16T00:49:55.000Z",
    "dateReserved": "2020-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T08:39:25.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-5666",
      "date": "2026-10-02",
      "epss": "0.08754",
      "percentile": "0.95013"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:mitsubishielectric:melsec_iq-r00_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BF204201-AB24-4566-93C1-8997D722541D",
                    "versionEndIncluding": "19",
                    "versionStartIncluding": "05",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:mitsubishielectric:melsec_iq-r00:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E329BB01-55F3-4ACA-83B1-C0A37C3C40DF",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:mitsubishielectric:melsec_iq-r01_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E095A274-0E64-404F-8336-B5E0317E71E8",
                    "versionEndIncluding": "19",
                    "versionStartIncluding": "05",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:mitsubishielectric:melsec_iq-r01:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3D2AB2EF-3607-4445-B144-1D2B8E84AFCD",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:mitsubishielectric:melsec_iq-r02_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C7FDCBD2-7935-45ED-BC4A-393CFCC5AD09",
                    "versionEndIncluding": "19",
                    "versionStartIncluding": "05",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:mitsubishielectric:melsec_iq-r02:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9A6A0DF8-2920-440E-9077-A51D574EB506",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:mitsubishielectric:melsec_iq-r04_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FE4DAD06-541F-42B3-93A3-4F8F7D7E849D",
                    "versionEndIncluding": "51",
                    "versionStartIncluding": "35",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:mitsubishielectric:melsec_iq-r04:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "58BDB040-8491-4C58-AC89-8C4826CC43BF",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:mitsubishielectric:melsec_iq-r16_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "72FA6BE6-0B85-4D48-A11B-A82C7427841A",
                    "versionEndIncluding": "51",
                    "versionStartIncluding": "35",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:mitsubishielectric:melsec_iq-r16:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5B3970C4-CE18-458B-829B-B9672B14B136",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:mitsubishielectric:melsec_iq-r08_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9E4DB9F1-D664-4297-9F2D-6B433A9F214A",
                    "versionEndIncluding": "51",
                    "versionStartIncluding": "35",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:mitsubishielectric:melsec_iq-r08:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "61A9CB49-8C99-469B-A6BB-B11D91851274",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:mitsubishielectric:melsec_iq-r32_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AC59FDC8-F352-479E-8AA1-3A7CF6283629",
                    "versionEndIncluding": "51",
                    "versionStartIncluding": "35",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:mitsubishielectric:melsec_iq-r32:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B387F367-2655-4511-A157-FB9C12B58B76",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:mitsubishielectric:melsec_iq-r120_firmware:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "59E65F90-82FA-4DAA-9388-0BE5172FCAE8",
                    "versionEndIncluding": "51",
                    "versionStartIncluding": "35",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:mitsubishielectric:melsec_iq-r120:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AA2F92FA-CD06-4D48-8412-A69FB76891EA",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Uncontrolled resource consumption vulnerability in MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versions from \u002705\u0027 to \u002719\u0027 and R04/08/16/32/120(EN)CPU Firmware versions from \u002735\u0027 to \u002751\u0027) allows a remote attacker to cause an error in a CPU unit via a specially crafted HTTP packet, which may lead to a denial-of-service (DoS) condition in execution of the program and its communication."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de consumo de recursos no controlado en MELSEC iQ-R Series CPU Modules (R00/01/02CPU Firmware versiones desde \"05\" hasta \"19\" y R04/08/16/32/120(EN)CPU Firmware versiones desde \"35\" hasta \"51\"), permite a un atacante remoto causar un error en una unidad de CPU por medio de un paquete HTTP especialmente dise\u00f1ado, lo que puede conllevar a una condici\u00f3n de denegaci\u00f3n de servicio (DoS) en la ejecuci\u00f3n del programa y su comunicaci\u00f3n"
          }
        ],
        "id": "CVE-2020-5666",
        "lastModified": "2024-11-21T05:34:26.980",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 7.1,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-11-16T01:15:13.327",
        "references": [
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/jp/JVN44764844/index.html"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/jp/JVN44764844/index.html"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Third Party Advisory",
              "US Government Resource"
            ],
            "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01"
          },
          {
            "source": "vultures@jpcert.or.jp",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/en/jp/JVN44764844/index.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://jvn.jp/jp/JVN44764844/index.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "US Government Resource"
            ],
            "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-317-01"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mitigation",
              "Vendor Advisory"
            ],
            "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-015_en.pdf"
          }
        ],
        "sourceIdentifier": "vultures@jpcert.or.jp",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-22T15:39:09+00:00",
      "cve": "CVE-2020-5666",
      "id": "CVE-2020-5666",
      "initial_release_date": "2020-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2020-5666",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-5666.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.