CVE-2020-5647 Missing authorization in GT14 Model of GOT 1000 series

Critical 9.8 Published 6 Nov 2020 Updated 4 Aug 2024

Remote unauthenticated attackers can execute malicious code or cause denial of service on Mitsubishi GOT 1000 HMI devices via crafted TCP/IP packets.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-5647?

CVE-2020-5647 is a critical missing authorization vulnerability in Mitsubishi Electric Corporation GT14 Model of GOT 1000 series, published on 6 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper access control vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier) allows a remote unauthenticated attacker to stop the network functions of the products or execute a malicious program via a specially crafted packet.

Which versions are affected by CVE-2020-5647?

It affects 1 product.

Products include Mitsubishielectric Coreos.

How do I fix CVE-2020-5647?

No fix has been published for CVE-2020-5647 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-5647 being exploited?

There is no known exploitation of CVE-2020-5647 in the wild and no public exploit code.

Sources

Also known as GHSA-cxvp-6fh6-vm2m.