by Kastro
Paper/Archive/CVE-2020-5648

CVE-2020-5648

Mitsubishi Electric Corporation GT14 Model of GOT 1000 series — Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmw…

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.1.891 × 2017.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of GT14 Model of GOT 1000 series (GT1455-QTBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QMBDE CoreOS version "05.65.00.BD" and earlier, GT1450-QLBDE CoreOS version "05.65.00.BD" and earlier, GT1455HS-QTBDE CoreOS version "05.65.00.BD" and earlier, and GT1450HS-QMBDE CoreOS version "05.65.00.BD" and earlier) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.

Affected

ProductAffectedFixed inSource
GT14 Model of GOT 1000 series(GT1455-QTBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QMBDE CoreOS version ’05.65.00.BD’ and earlier, GT1450-QLBDE CoreOS version ’05.65.00.BD’ and earlier, GT1455HS-QTBDE CoreOS version ’05.65.00.BD’ and earlier, and GT1450HS-QMBDE CoreOS version ’05.65.00.BD’ and earlier)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refus-cert.cisa.gov/ics/advisories/icsa-20-310-02refmitsubishielectric.com/en/psirt/vulnerability/pdf/2020-014_en.pdfrefmitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-014.pdfrefjvn.jp/vu/JVNVU99562395/index.html