Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2020-5546

Summary
Assigner-jpcert
Assigner Org ID-ede6fdc4-6654-4307-a26d-3331c018e2ce
Published At-16 Mar, 2020 | 01:25
Updated At-04 Aug, 2024 | 08:30
Rejected At-
Credits

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functions or execute malware via a specially crafted packet.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:jpcert
Assigner Org ID:ede6fdc4-6654-4307-a26d-3331c018e2ce
Published At:16 Mar, 2020 | 01:25
Updated At:04 Aug, 2024 | 08:30
Rejected At:
▼CVE Numbering Authority (CNA)

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functions or execute malware via a specially crafted packet.

Affected Products
Vendor
Mitsubishi Electric CorporationMitsubishi Electric Corporation
Product
Mitsubishi Electric MELQIC IU1 series
Versions
Affected
  • IU1-1M20-D firmware version 1.0.7 and earlier
Problem Types
TypeCWE IDDescription
textN/AImproper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Type: text
CWE ID: N/A
Description: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://jvn.jp/en/vu/JVNVU92370624/index.html
x_refsource_MISC
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf
x_refsource_MISC
Hyperlink: https://jvn.jp/en/vu/JVNVU92370624/index.html
Resource:
x_refsource_MISC
Hyperlink: https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf
Resource:
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://jvn.jp/en/vu/JVNVU92370624/index.html
x_refsource_MISC
x_transferred
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf
x_refsource_MISC
x_transferred
Hyperlink: https://jvn.jp/en/vu/JVNVU92370624/index.html
Resource:
x_refsource_MISC
x_transferred
Hyperlink: https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf
Resource:
x_refsource_MISC
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:vultures@jpcert.or.jp
Published At:16 Mar, 2020 | 02:15
Updated At:19 Mar, 2020 | 16:25

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functions or execute malware via a specially crafted packet.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.18.8HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary2.05.8MEDIUM
AV:A/AC:L/Au:N/C:P/I:P/A:P
Type: Primary
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 2.0
Base score: 5.8
Base severity: MEDIUM
Vector:
AV:A/AC:L/Au:N/C:P/I:P/A:P
CPE Matches
Mitsubishi Electric Corporation
mitsubishielectric
>>iu1-1m20-d_firmware>>Versions up to 1.0.7(inclusive)
cpe:2.3:o:mitsubishielectric:iu1-1m20-d_firmware:*:*:*:*:*:*:*:*
Mitsubishi Electric Corporation
mitsubishielectric
>>iu1-1m20-d>>-
cpe:2.3:h:mitsubishielectric:iu1-1m20-d:-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-88Primarynvd@nist.gov
CWE ID: CWE-88
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://jvn.jp/en/vu/JVNVU92370624/index.htmlvultures@jpcert.or.jp
Third Party Advisory
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdfvultures@jpcert.or.jp
Patch
Vendor Advisory
Hyperlink: https://jvn.jp/en/vu/JVNVU92370624/index.html
Source: vultures@jpcert.or.jp
Resource:
Third Party Advisory
Hyperlink: https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdf
Source: vultures@jpcert.or.jp
Resource:
Patch
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

3Records found
CVE-2020-5657
Matching Score-6
Assigner-JPCERT/CC
ShareView Details
Matching Score-6
Assigner-JPCERT/CC
CVSS Score-6.5||MEDIUM
EPSS-0.17% / 38.74%
||
7 Day CHG~0.00%
Published-30 Oct, 2020 | 03:35
Updated-04 Aug, 2024 | 08:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.

Action-Not Available
Vendor-Mitsubishi Electric Corporation
Product-melsec_iq-rd81opc96melsec_iq-rd81dl96_firmwaremelsec_iq-rd81dl96melsec_iq-rj71pn92melsec_iq-rd81mes96n_firmwaremelsec_iq-rd81mes96nmelsec_iq-rj71eip91_firmwaremelsec_iq-rj71eip91melsec_iq-rd81opc96_firmwaremelsec_iq-rj71pn92_firmwareMELSEC iQ-R series
CWE ID-CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVE-2020-5648
Matching Score-6
Assigner-JPCERT/CC
ShareView Details
Matching Score-6
Assigner-JPCERT/CC
CVSS Score-9.8||CRITICAL
EPSS-0.71% / 71.42%
||
7 Day CHG~0.00%
Published-06 Nov, 2020 | 02:06
Updated-04 Aug, 2024 | 08:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.

Action-Not Available
Vendor-Mitsubishi Electric Corporation
Product-gt1450-qmbdegt1455-qtbdecoreosgt1450-qlbdegt1450hs-qmbdegt1455hs-qtbdeGT14 Model of GOT 1000 series
CWE ID-CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CVE-2020-5599
Matching Score-6
Assigner-JPCERT/CC
ShareView Details
Matching Score-6
Assigner-JPCERT/CC
CVSS Score-9.8||CRITICAL
EPSS-1.26% / 78.54%
||
7 Day CHG~0.00%
Published-07 Jul, 2020 | 08:05
Updated-04 Aug, 2024 | 08:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.

Action-Not Available
Vendor-Mitsubishi Electric Corporation
Product-got2000_gt27got2000_gt23coreosgot2000_gt25GOT2000 series GT27, GT25, and GT23
CWE ID-CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Details not found