Detections
Analytics
Mitsubishi Electric MELSEC iQ-R Series Uncontrolled Resource Consumption (CVE-2020-16850)
high Tenable OT Security Plugin ID 500588
Synopsis
The remote OT asset is affected by a vulnerability.Description
Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2.This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.Mitsubishi Electric recommends that users update to the following:
- iQ-R series R00CPU: Versions "21" or later
- iQ-R series R01CPU: Versions "21" or later
- iQ-R series R02CPU; Versions "21" or later
- iQ-R series R04CPU: Versions "53" or later
- iQ-R series R08CPU: Versions "53" or later
- iQ-R series R16CPU: Versions "53" or later
- iQ-R series R32CPU: Versions "53" or later
- iQ-R series R120CPU: Versions "53" or later
- iQ-R series R04ENCPU: Versions "53" or later
- iQ-R series R08ENCPU: Versions "53" or later
- iQ-R series R16ENCPU: Versions "53" or later
- iQ-R series R32ENCPU: Versions "53" or later
- iQ-R series R120ENCPU: Versions "53" or later
- iQ-R series R08FCPU: Versions "23" or later
- iQ-R series R16FCPU: Versions "23" or later
- iQ-R series R32FCPU: Versions "23" or later
- iQ-R series R120FCPU: Versions "23" or later
- iQ-R series R08PCPU: Versions "26" or later
- iQ-R series R16PCPU: Versions "26" or later
- iQ-R series R32PCPU: Versions "26" or later
- iQ-R series R120PCPU: Versions "26" or later
- iQ-R series R16MTCPU Operating system software: Versions "22" or later
- iQ-R series R32MTCPU Operating system software: Versions "22" or later
- iQ-R series R64MTCPU Operating system software: Versions "22" or later
See the Mitsubishi Electric Advisory for the availability of updates for each product.
Mitsubishi Electric recommends users take the following mitigation measures to minimize the risk of exploiting this vulnerability:
- Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.
- Use within a LAN and block access from untrusted networks and hosts though firewalls.
For specific update instructions and additional details see the Mitsubishi Electric advisory.
See Also
Plugin Details
Severity: High
ID: 500588
File Name: tenable_ot_mitsubishi_CVE-2020-16850.nasl
Version: 1.10
Type: remote
Family: Tenable.ot
Published: 2/7/2022
Updated: 2/14/2026
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2020-16850
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:mitsubishielectric:r02cpu_firmware, cpe:/o:mitsubishielectric:r32pcpu_firmware, cpe:/o:mitsubishielectric:r08pcpu_firmware, cpe:/o:mitsubishielectric:r00cpu_firmware, cpe:/o:mitsubishielectric:r64mtcpu_firmware, cpe:/o:mitsubishielectric:r120cpu_firmware, cpe:/o:mitsubishielectric:r01cpu_firmware, cpe:/o:mitsubishielectric:r16pcpu_firmware, cpe:/o:mitsubishielectric:r16mtcpu_firmware, cpe:/o:mitsubishielectric:r16sfcpu_firmware, cpe:/o:mitsubishielectric:r32cpu_firmware, cpe:/o:mitsubishielectric:r120sfcpu_firmware, cpe:/o:mitsubishielectric:r16cpu_firmware, cpe:/o:mitsubishielectric:r32sfcpu_firmware, cpe:/o:mitsubishielectric:r08sfcpu_firmware, cpe:/o:mitsubishielectric:r32mtcpu_firmware, cpe:/o:mitsubishielectric:r08cpu_firmware, cpe:/o:mitsubishielectric:r120pcpu_firmware, cpe:/o:mitsubishielectric:r04cpu_firmware
Required KB Items: Tenable.ot/Mitsubishi
Exploit Ease: No known exploits are available
Patch Publication Date: 11/30/2020
Vulnerability Publication Date: 11/30/2020
Reference Information
CVE: CVE-2020-16850