CVE-2020-5649 Denial of service in GT14 Model of GOT 1000 series

High 7.5 Published 6 Nov 2020 Updated 4 Aug 2024

Remote unauthenticated attackers can cause denial of service in Mitsubishi GOT 1000 series HMIs by sending specially crafted packets.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-5649?

CVE-2020-5649 is a high-severity denial of service vulnerability in Mitsubishi Electric Corporation GT14 Model of GOT 1000 series, published on 6 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Resource management error vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows a remote unauthenticated attacker to stop the network functions of the products via a specially crafted packet.

Which versions are affected by CVE-2020-5649?

It affects 1 product.

Products include Mitsubishielectric Coreos.

How do I fix CVE-2020-5649?

No fix has been published for CVE-2020-5649 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-5649 being exploited?

There is no known exploitation of CVE-2020-5649 in the wild and no public exploit code.

Sources

Also known as GHSA-7r5g-2r48-38jg.