CVE-2020-16226 Mitsubishi Electric Multiple Products
Attackers can impersonate legitimate devices to remotely execute arbitrary commands on Mitsubishi Electric industrial control products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-16226?
CVE-2020-16226 is a critical authentication bypass vulnerability in Mitsubishi Electric Conveyor Tracking Application, published on 5 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands.
Weakness: CWE-342
Which versions are affected by CVE-2020-16226?
It affects 95 products.
Products include Mitsubishielectric Conveyor Tracking Application Apr-Ntr12fh, Mitsubishielectric Conveyor Tracking Application Apr-Ntr20fh\(n\=1\,2\), Mitsubishielectric Conveyor Tracking Application Apr-Ntr3fh, Mitsubishielectric Conveyor Tracking Application Apr-Ntr6fh, Mitsubishielectric Fr-A820-E Firmware, Mitsubishielectric Fr-A840-E Firmware and 89 more.
How do I fix CVE-2020-16226?
No fix has been published for CVE-2020-16226 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-16226 being exploited?
There is no known exploitation of CVE-2020-16226 in the wild and no public exploit code.
Sources
Also known as GHSA-4548-gq2g-hw87.