CVE-2020-5644 Memory corruption in GT14 Model of GOT 1000 series

Critical 9.8 Published 6 Nov 2020 Updated 4 Aug 2024

Remote unauthenticated attackers can cause denial of service or execute arbitrary code via crafted packets in Mitsubishi GOT 1000 series HMI firmware.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-5644?

CVE-2020-5644 is a critical memory corruption vulnerability in Mitsubishi Electric Corporation GT14 Model of GOT 1000 series, published on 6 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Buffer overflow vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.

Weakness: CWE-120

Which versions are affected by CVE-2020-5644?

It affects 1 product.

Products include Mitsubishielectric Coreos.

How do I fix CVE-2020-5644?

No fix has been published for CVE-2020-5644 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-5644 being exploited?

There is no known exploitation of CVE-2020-5644 in the wild and no public exploit code.

Sources

Also known as GHSA-886m-rmg5-rwvm.