CVE-2020-5546

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functions or execute malware via a specially crafted packet.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
Mitsubishi Electric Corporation	Mitsubishi Electric MELQIC IU1 series	IU1-1M20-D firmware version 1.0.7 and earlier

References

https://jvn.jp/en/vu/JVNVU92370624/index.htmlThird Party Advisory
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdfPatch, Vendor Advisory
https://jvn.jp/en/vu/JVNVU92370624/index.htmlThird Party Advisory
https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2019-004.pdfPatch, Vendor Advisory

Timeline

Published: Mar 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-55479.8Resource Management Errors vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmwa CVE-2020-55487.5Yamaha LTE VoIP Router(NVR700W firmware Rev.15.00.15 and earlier), Yamaha Gigabit VoIP Router(NVR510 firmware Rev.15.01.14 and earlier), Yam CVE-2020-55498.8Cross-site request forgery (CSRF) vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier and Enterprise Ver. 2.0.1 and earlier allows remot CVE-2020-55508.1Session fixation vulnerability in EasyBlocks IPv6 Ver. 2.0.1 and earlier, and Enterprise Ver. 2.0.1 and earlier allows remote attackers to i CVE-2020-55518.8Toyota 2017 Model Year DCU (Display Control Unit) allows an unauthenticated attacker within Bluetooth range to cause a denial of service att CVE-2020-55526.1Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified v CVE-2020-55539.8mailform version 1.04 allows remote attackers to execute arbitrary PHP code via unspecified vectors.CVE-2020-55549.1Directory traversal vulnerability in Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write arbitrary files CVE-2020-55559.1Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to read and write data of the files placed in the same directory where CVE-2020-55569.8Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors.CVE-2020-55576.1Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2020-55588.8CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors.