ByteOS

Product

MELSEC iQ-R series

Versions

Affected

RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before

Problem Types

Type	CWE ID	Description
text	N/A	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Type: text

CWE ID: N/A

Description: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

References

Hyperlink	Resource
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf	x_refsource_MISC
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf	x_refsource_MISC
https://jvn.jp/vu/JVNVU92513419/index.html	x_refsource_MISC

Hyperlink: https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf

Resource:

x_refsource_MISC

Hyperlink: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf

Resource:

x_refsource_MISC

Hyperlink: https://jvn.jp/vu/JVNVU92513419/index.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf	x_refsource_MISC x_transferred
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf	x_refsource_MISC x_transferred
https://jvn.jp/vu/JVNVU92513419/index.html	x_refsource_MISC x_transferred

Hyperlink: https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://jvn.jp/vu/JVNVU92513419/index.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:vultures@jpcert.or.jp

Published At:02 Nov, 2020 | 21:15

Updated At:10 Nov, 2020 | 14:22

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary	2.0	3.3	LOW	AV:A/AC:L/Au:N/C:N/I:N/A:P

Type: Primary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Primary

Version: 2.0

Base score: 3.3

Base severity: LOW

Vector:

AV:A/AC:L/Au:N/C:N/I:N/A:P

CPE Matches

cpe:2.3:o:mitsubishielectric:melsec_iq-rj71eip91_firmware:-:*:*:*:*:*:*:*

>>melsec_iq-rj71eip91_firmware>>-

cpe:2.3:h:mitsubishielectric:melsec_iq-rj71eip91:-:*:*:*:*:*:*:*

>>melsec_iq-rj71eip91>>-

cpe:2.3:o:mitsubishielectric:melsec_iq-rj71pn92_firmware:-:*:*:*:*:*:*:*

>>melsec_iq-rj71pn92_firmware>>-

cpe:2.3:h:mitsubishielectric:melsec_iq-rj71pn92:-:*:*:*:*:*:*:*

>>melsec_iq-rj71pn92>>-

cpe:2.3:o:mitsubishielectric:melsec_iq-rd81dl96_firmware:-:*:*:*:*:*:*:*

>>melsec_iq-rd81dl96_firmware>>-

cpe:2.3:h:mitsubishielectric:melsec_iq-rd81dl96:-:*:*:*:*:*:*:*

>>melsec_iq-rd81dl96>>-

cpe:2.3:o:mitsubishielectric:melsec_iq-rd81mes96n_firmware:-:*:*:*:*:*:*:*

>>melsec_iq-rd81mes96n_firmware>>-

cpe:2.3:h:mitsubishielectric:melsec_iq-rd81mes96n:-:*:*:*:*:*:*:*

>>melsec_iq-rd81mes96n>>-

cpe:2.3:o:mitsubishielectric:melsec_iq-rd81opc96_firmware:-:*:*:*:*:*:*:*

>>melsec_iq-rd81opc96_firmware>>-

cpe:2.3:h:mitsubishielectric:melsec_iq-rd81opc96:-:*:*:*:*:*:*:*

>>melsec_iq-rd81opc96>>-

Weaknesses

CWE ID	Type	Source
CWE-88	Primary	nvd@nist.gov

CWE ID: CWE-88

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://jvn.jp/vu/JVNVU92513419/index.html	vultures@jpcert.or.jp	Third Party Advisory
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf	vultures@jpcert.or.jp	Vendor Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf	vultures@jpcert.or.jp	Vendor Advisory

Hyperlink: https://jvn.jp/vu/JVNVU92513419/index.html

Source: vultures@jpcert.or.jp

Resource:

Third Party Advisory

Hyperlink: https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf

Source: vultures@jpcert.or.jp

Resource:

Vendor Advisory

Hyperlink: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf

Source: vultures@jpcert.or.jp

Resource:

Vendor Advisory

Similar CVEs

4Records found

CVE-2020-5665

Matching Score-8

Assigner-JPCERT/CC

Matching Score-8

Assigner-JPCERT/CC

CVSS Score-7.4||HIGH

EPSS-0.18% / 39.66%

7 Day CHG~0.00%

Published-14 Dec, 2020 | 02:25

Updated-04 Aug, 2024 | 08:39

Improper check or handling of exceptional conditions in MELSEC iQ-F series FX5U(C) CPU unit firmware version 1.060 and earlier allows an attacker to cause a denial-of-service (DoS) condition on program execution and communication by sending a specially crafted ARP packet.

Product-melsec_iq-f_fx5u_cpu_firmware melsec_iq-f_fx5u_cpu MELSEC iQ-F series FX5U(C) CPU unit

CVE-2020-5648

Matching Score-6

Assigner-JPCERT/CC

Matching Score-6

Assigner-JPCERT/CC

CVSS Score-9.8||CRITICAL

EPSS-0.71% / 71.41%

7 Day CHG~0.00%

Published-06 Nov, 2020 | 02:06

Updated-04 Aug, 2024 | 08:39

Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.

Product-gt1450-qmbde gt1455-qtbde coreos gt1450-qlbde gt1450hs-qmbde gt1455hs-qtbde GT14 Model of GOT 1000 series

CWE ID-CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CVE-2020-5599

Matching Score-6

Assigner-JPCERT/CC

Matching Score-6

Assigner-JPCERT/CC

CVSS Score-9.8||CRITICAL

EPSS-1.26% / 78.53%

7 Day CHG~0.00%

Published-07 Jul, 2020 | 08:05

Updated-04 Aug, 2024 | 08:30

TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.

Product-got2000_gt27 got2000_gt23 coreos got2000_gt25 GOT2000 series GT27, GT25, and GT23

CWE ID-CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

CVE-2020-5546

Matching Score-6

Assigner-JPCERT/CC

Matching Score-6

Assigner-JPCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.16% / 37.59%

7 Day CHG~0.00%

Published-16 Mar, 2020 | 01:25

Updated-04 Aug, 2024 | 08:30

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functions or execute malware via a specially crafted packet.