CVE-2020-5596 Other in GOT2000 series GT27, GT25, and GT23
Remote attackers can execute malicious code or cause denial of service on Mitsubishi Electric GOT2000 HMIs via crafted packets due to improper session management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5596?
CVE-2020-5596 is a high-severity vulnerability in Mitsubishi Electric Corporation GOT2000 series GT27, GT25, and GT23, published on 7 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) does not properly manage sessions, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Weakness: CWE-384
Which versions are affected by CVE-2020-5596?
It affects 1 product.
Products include Mitsubishielectric Coreos.
How do I fix CVE-2020-5596?
No fix has been published for CVE-2020-5596 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-5596 being exploited?
There is no known exploitation of CVE-2020-5596 in the wild and no public exploit code.
Other vulnerabilities in Mitsubishi Electric Corporation GOT2000 series GT27, GT25, and GT23
- CVE-2020-5644 Memory corruption in GT14 Model of GOT 1000 series
- CVE-2020-5647 Missing authorization in GT14 Model of GOT 1000 series
- CVE-2020-5648 Command injection in GT14 Model of GOT 1000 series
- CVE-2020-5595 Memory corruption in GOT2000 series GT27, GT25, and GT23
- CVE-2020-5599 Command injection in GOT2000 series GT27, GT25, and GT23
Sources
Also known as GHSA-gpgq-86h5-hrxm.