What is the CVSS score of CVE-2020-5527?

CVE-2020-5527 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.3%.

Cr800 Q Firmware CVE-2020-5527

HIGH

Uncontrolled Resource Consumption (CWE-400)

2020-03-30 vultures@jpcert.or.jp

Denial Of Service Cr800 Q Firmware Fx3G Firmware Fx3Gc Firmware Fx3S Firmware Fx3U Firmware Fx3Uc Firmware Fx5U Firmware Fx5Uc Firmware Fx5Uj Firmware L02Cpu Firmware L02Cpu P Firmware L02Scpu Firmware L02Scpu P Firmware L06Cpu Firmware L06Cpu P Firmware L26Cpu Firmware L26Cpu Bt Firmware L26Cpu P Firmware L26Cpu Pbt Firmware Q02Phcpu Firmware Q06Phcpu Firmware Q12Dccpu V Firmware Q12Phcpu Firmware Q12Prhcpu Firmware Q172Dscpu Firmware Q173Dscpu Firmware Q173Nccpu Firmware Q24Dhccpu Ls Firmware Q24Dhccpu V Firmware Q24Dhccpu Vg2 Firmware Q25Phcpu Firmware Q25Prhcpu Firmware Q26Dhccpu Ls Firmware R00Cpu Firmware R01Cpu Firmware R02Cpu Firmware R04Cpu Firmware R04Encpu Firmware R08Cpu Firmware R08Encpu Firmware R120Cpu Firmware R120Encpu Firmware R16Cpu Firmware R16Encpu Firmware R32Cpu Firmware R32Encpu Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Mar 30, 2020 - 08:15 nvd

HIGH 7.5

DescriptionNVD

When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource consumption occurs and the port does not process the data properly. As a result, it may fall into a denial-of-service (DoS) condition. The vendor states this vulnerability only affects Ethernet communication functions.

AnalysisAI

When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions),. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources. When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource consumption occurs and the port does not process the data properly. As a result, it may fall into a denial-of-service (DoS) condition. The vendor states this vulnerability only affects Ethernet communication functions. Affected products include: Mitsubishielectric Cr800-Q Firmware, Mitsubishielectric Fx3G Firmware, Mitsubishielectric Fx3Gc Firmware, Mitsubishielectric Fx3S Firmware, Mitsubishielectric Fx3U Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.