High severity · published Jun 30, 2020
CVE-2020-5603
Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
Uncontrolled resource consumption vulnerability in Mitsubishi Electoric FA Engineering Software (CPU Module Logging Configuration Tool Ver. 1.94Y and earlier, CW Configurator Ver. 1.010L and earlier, EM Software Development Kit (EM Configurator) Ver. 1.010L and earlier, GT Designer3 (GOT2000) Ver. 1.221F and earlier, GX LogViewer Ver. 1.96A and earlier, GX Works2 Ver. 1.586L and earlier, GX Works3 Ver. 1.058L and earlier, M_CommDTM-HART Ver. 1.00A, M_CommDTM-IO-Link Ver. 1.02C and earlier, MELFA-Works Ver. 4.3 and earlier, MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool Ver.1.004E and earlier, MELSOFT FieldDeviceConfigurator Ver. 1.03D and earlier, MELSOFT iQ AppPortal Ver. 1.11M and earlier, MELSOFT Navigator Ver. 2.58L and earlier, MI Configurator Ver. 1.003D and earlier, Motion Control Setting Ver. 1.005F and earlier, MR Configurator2 Ver. 1.72A and earlier, MT Works2 Ver. 1.156N and earlier, RT ToolBox2 Ver. 3.72A and earlier, and RT ToolBox3 Ver. 1.50C and earlier) allows an attacker to cause a denial of service (DoS) condition attacks via unspecified vectors.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CW Configurator · Mitsubishielectric
through 1.010l · source: NVD
CM
Cpu Module Logging Configuration Tool · Mitsubishielectric
through 1.94y · source: NVD
EC
EM Configurator · Mitsubishielectric
through 1.010l · source: NVD
GD
GT Designer3 · Mitsubishielectric
through 1.221f · source: NVD
GL
GX Logviewer · Mitsubishielectric
through 1.100e · source: NVD
GW
GX Works2 · Mitsubishielectric
through 1.590q · source: NVD
GW
GX Works3 · Mitsubishielectric
through 1.060n · source: NVD
MC
M Commdtm-hart · Mitsubishielectric
through 1.01b · source: NVD
MC
M Commdtm-io-link · Mitsubishielectric
through 1.03d · source: NVD
MC
MI Configurator · Mitsubishielectric
through 1.004e · source: NVD
MC
MR Configurator2 · Mitsubishielectric
through 1.100e · source: NVD
MW
MT Works2 · Mitsubishielectric
through 1.160s · source: NVD
Affected product
CM
Cpu Module Logging Configuration Tool
Mitsubishielectric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5603
Third Party Advisory
https://jvn.jp/en/vu/JVNVU90307594/index.html
Mitigation
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-004_en.pdf
More from Cpu Module Logging Configuration Tool
9.8
CVE-2020-14496
Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various versions could allow an attacker to…
9.8
CVE-2020-14521
Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability
9.8
CVE-2021-20588
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior,…
9.8
CVE-2021-20587
Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions…
7.8
CVE-2024-26314
Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary code