CVE-2020-16850

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Nov 30, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-168517.1<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An atCVE-2020-168527.1<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An atCVE-2020-168537.1<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An atCVE-2020-168545.5<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfullyCVE-2020-168555.5<p>An information disclosure vulnerability exists when Microsoft Office software reads out of bound memory due to an uninitialized variable,CVE-2020-168567.8<p>A remote code execution vulnerability exists in Visual Studio when it improperly handles objects in memory. An attacker who successfully CVE-2020-168577.1<p>A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations (on-premises) version 10.0.11. An attacCVE-2020-168585.4<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web CVE-2020-168595.4<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web CVE-2020-16867.5On Juniper Networks Junos OS devices, receipt of a malformed IPv6 packet may cause the system to crash and restart (vmcore). This issue can CVE-2020-168606.8<p>A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requeCVE-2020-168615.4<p>A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web
CVE-2020-16850: High severity, CVSS 7.5 | Vulnix