CVE-2020-5600 Denial of service in GOT2000 series GT27, GT25, and GT23
Remote attackers can cause denial of service or execute malicious code on Mitsubishi Electric GOT2000 HMIs via crafted packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5600?
CVE-2020-5600 is a high-severity denial of service vulnerability in Mitsubishi Electric Corporation GOT2000 series GT27, GT25, and GT23, published on 7 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a resource management error vulnerability, which may allow a remote attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.
Which versions are affected by CVE-2020-5600?
It affects 1 product.
Products include Mitsubishielectric Coreos.
How do I fix CVE-2020-5600?
No fix has been published for CVE-2020-5600 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-5600 being exploited?
There is no known exploitation of CVE-2020-5600 in the wild and no public exploit code.
Other vulnerabilities in Mitsubishi Electric Corporation GOT2000 series GT27, GT25, and GT23
- CVE-2020-5644 Memory corruption in GT14 Model of GOT 1000 series
- CVE-2020-5647 Missing authorization in GT14 Model of GOT 1000 series
- CVE-2020-5648 Command injection in GT14 Model of GOT 1000 series
- CVE-2020-5595 Memory corruption in GOT2000 series GT27, GT25, and GT23
- CVE-2020-5599 Command injection in GOT2000 series GT27, GT25, and GT23
Sources
Also known as GHSA-wjpf-6j9q-4h5x.