CVE-2020-13238

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mitsubishi MELSEC iQ-R Series PLCs with firmware 33 allow attackers to halt the industrial process by sending an unauthenticated crafted packet over the network, because this denial of service attack consumes excessive CPU time. After halting, physical access to the PLC is required in order to restore production.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/vu/JVNVU97662844/index.htmlThird Party Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-001_en.pdfVendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-161-02Third Party Advisory, US Government Resource
http://jvn.jp/vu/JVNVU97662844/index.htmlThird Party Advisory
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-001_en.pdfVendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-161-02Third Party Advisory, US Government Resource

Timeline

Published: Jun 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-132395.4The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the dir CVE-2020-13247.8An elevation of privilege (user to user) vulnerability exists in Windows Security Health Service when handling certain objects in memory.To CVE-2020-132405.4The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecu CVE-2020-132417.8Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load_module:users#edit-user=1 does not verify that the file ext CVE-2020-132455.9Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, an CVE-2020-132467.5An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership fro CVE-2020-132477.3BooleBox Secure File Sharing Utility before 4.2.3.0 allows CSV injection via a crafted user name that is mishandled during export from the a CVE-2020-132485.4BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx CVE-2020-132498.8libmariadb/mariadb_lib.c in MariaDB Connector/C before 3.1.8 does not properly validate the content of an OK packet received from a server. CVE-2020-13255.4Azure DevOps Server and Team Foundation Services Spoofing Vulnerability CVE-2020-132507.5HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vuln CVE-2020-132528.8Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path