CVE-2020-5648 Command injection in GT14 Model of GOT 1000 series

Critical 9.8 Published 6 Nov 2020 Updated 4 Aug 2024

Unauthenticated attackers on adjacent networks can cause denial of service in Mitsubishi GOT 1000 series HMIs via argument injection in TCP/IP functions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-5648?

CVE-2020-5648 is a critical command injection vulnerability in Mitsubishi Electric Corporation GT14 Model of GOT 1000 series, published on 6 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.

Weakness: CWE-88

Which versions are affected by CVE-2020-5648?

It affects 1 product.

Products include Mitsubishielectric Coreos.

How do I fix CVE-2020-5648?

No fix has been published for CVE-2020-5648 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-5648 being exploited?

There is no known exploitation of CVE-2020-5648 in the wild and no public exploit code.

Sources

Also known as GHSA-fxq3-4vfx-993f.