QID 590601

Date Published: 2022-03-17

QID 590601: Mitsubishi Electric Multiple Products (Update C) Predictable Exact Value from Previous Values Vulnerability (ICSA-20-245-01)

AFFECTED PRODUCTS
QJ71MES96, all versions
QJ71WS96, all versions
Q06CCPU-V, all versions
Q24DHCCPU-V, all versions
Q24DHCCPU-VG, all versions
R12CCPU-V, Version 13 and prior
RD55UP06-V, Version 09 and prior
RD55UP12-V, Version 01
RJ71GN11-T2, Version 11 and prior
RD78Gn(n=4,8,16,32,64), Version 14 and prior
RD78GHV, Version 14 and prior
RD78GHW, Version 14 and prior
NZ2FT-MT, all versions
NZ2FT-EIP, all versions
Q03UDECPU, the first 5 digits of serial number 22081 and prior
QnUDEHCPU(n=04/06/10/13/20/26/50/100), the first 5 digits of serial number 22081 and prior
QnUDVCPU(n=03/04/06/13/26), the first 5 digits of serial number 22031 and prior
QnUDPVCPU(n=04/06/13/26), the first 5 digits of serial number 22031 and prior
LnCPU(-P)(n=02/06/26), the first 5 digits of serial number 22051 and prior
L26CPU-(P)BT, the first 5 digits of serial number 22051 and prior
RnCPU(n=00/01/02), Version 18 and prior
RnCPU(n=04/08/16/32/120), Version 50 and prior
RnENCPU(n=04/08/16/32/120), Version 50 and prior
RnSFCPU (n=08/16/32/120), Version 22 and prior
RnPCPU(n=08/16/32/120), Version 24 and prior
RnPSFCPU(n=08/16/32/120), Version 05 and prior
FX5U(C)-**M*/**


Case1: Serial number 17X**** or later: Version 1.210 and prior
Case2: Serial number 179**** and prior: Version 1.070 and prior
Successful exploitation of this vulnerability could be used to hijack TCP sessions and allow remote command execution.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as High - 7.5 severity.
    • Solution

    Customers are advised to refer to CERT MITIGATIONS section ICSA-20-245-01 for affected packages and patching details.
    FX5UC-32M*/**-TS, Version 1.210 and prior
    FX5UJ-**M*/**, Version 1.000
    FX5-ENET, Version 1.002 and prior
    FX5-ENET/IP, Version 1.002 and prior
    FX3U-ENET-ADP, Version 1.22 and prior
    FX3GE-**M*/**, the first 3 digits of serial number 20X and prior
    FX3U-ENET, Version 1.14 and prior
    FX3U-ENET-L, Version 1.14 and prior
    FX3U-ENET-P502, Version 1.14 and prior
    FX5-CCLGN-MS, Version 1.000
    IU1-1M20-D, all versions
    LE7-40GU-L, all versions
    GOT2000 Series GT21 Model, all versions
    GS Series, all versions
    GOT1000 Series GT14 Model, all versions
    FR-A800-E Series, production date December 2020 and prior
    FR-F800-E Series, production date December 2020 and prior
    FR-A8NCG, Production date August 2020 and prior
    FR-E800-EPA Series, Production date July 2020 and prior
    FR-E800-EPB Series, Production date July 2020 and prior
    Conveyor Tracking Application APR-nTR3FH, APR-nTR6FH, APR-nTR12FH, APR-nTR20FH(n=1,2), all versions (Discontinued product)
    MR-JE-C, all versions
    MR-J4-TM, all versions
    RJ71EN71, Version 48 and prior
    QJ71E71-100, the first 5 digits of serial number 21092 and prior
    LJ71E71-100, the first 5 digits of serial number 21092 and prior
    QJ71MT91, the first 5 digits of serial number 20082 and prior
    NZ2GACP620-60, Version 1.03D and prior
    NZ2GACP620-300, Version 1.03D and prior
    GT25-J71GN13-T2, Version 03 and prior

    QID Detection Logic (Authenticated):
    QID checks for the Vulnerable version of using passive scanning

    Vendor References

    CVEs related to QID 590601

    CVE-2020-16226 |
    Software Advisories
    Advisory ID Software Component Link
    ICSA-20-245-01 URL Logo www.us-cert.gov/ics/advisories/ICSA-20-245-01
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].