What is the CVSS score of CVE-2019-6535?

CVE-2019-6535 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 4.3%.

Q03Udecpu Firmware CVE-2019-6535

HIGH

Uncontrolled Resource Consumption (CWE-400)

2019-02-05 ics-cert@hq.dhs.gov

Denial Of Service Q03Udecpu Firmware Q04Udehcpu Firmware Q04Udpvcpu Firmware Q04Udvcpu Firmware Q100Udehcpu Firmware Q50Udehcpu Firmware Q26Udehcpu Firmware Q26Udpvcpu Firmware Q26Udvcpu Firmware Q20Udehcpu Firmware Q13Udehcpu Firmware Q13Udpvcpu Firmware Q13Udvcpu Firmware Q10Udehcpu Firmware Q06Udehcpu Firmware Q06Udpvcpu Firmware Q06Udvcpu Firmware Q03Udvcpu Firmware Mitsubishielectric

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Feb 05, 2019 - 19:29 nvd

HIGH 7.5

DescriptionNVD

Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication.

AnalysisAI

Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. Mitsubishi Electric Q03/04/06/13/26UDVCPU: serial number 20081 and prior, Q04/06/13/26UDPVCPU: serial number 20081 and prior, and Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU: serial number 20101 and prior. A remote attacker can send specific bytes over Port 5007 that will result in an Ethernet stack crash and disruption to USB communication. Affected products include: Mitsubishielectric Q03Udvcpu Firmware, Mitsubishielectric Q04Udvcpu Firmware, Mitsubishielectric Q06Udvcpu Firmware, Mitsubishielectric Q13Udvcpu Firmware, Mitsubishielectric Q26Udvcpu Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.