Network security course specialists reported the finding of at least six vulnerabilities in various Mitsubishi Electric GOT2000 Series machine-man interface models. According to the report, the successful exploitation of these flaws would lead to scenarios such as buffer overflow, among others.
Below are brief descriptions of the reported flaws, in addition to their respective tracking keys and scores according to the Common Vulnerability Scoring System (CVSS).
CVE-2020-5595: A boundary error in the TCP/IP function allows remote hackers to execute arbitrary code on the target system. Exploiting this flaw would allow hackers to take full control over the affected implementation.
The flaw received a score of 8.5/10, making it a critical error.
CVE-2020-5596: A session override issue in the TCP/IP feature allows remote hackers to deploy denial of service (DoS) attacks sent specially designed packets. This is an average vulnerability that received a score of 6.5/10.
CVE-2020-5597: A NULL pointer dereference flaw in the target system’s TCP/IP function allows remote threat actors to deploy DoS attacks by sending specially crafted packets.
The flaw received a score of 6.5/10, so it is considered medium severity, network security course specialists mentioned.
CVE-2020-5598: This vulnerability exists due to inadequate restrictions on access to the TCP/IP function, allowing remote hackers to gain unauthorized access to restricted functions by gaining access to the affected application.
This is a severe vulnerability that received a score of 8.5/10 on the CVSS scale.
CVE-2020-5599: This flaw exists due to incorrect neutralization of arguments in a command within the TCP/IP function, which would allow attackers to perform denial of service attacks by sending specially designed packets to the target application, network security course specialists mentioned.
The flaw received a score of 6.2/10, so it is considered a low severity vulnerability.
CVE-2020-5600: Inadequate resource management in the TCP/IP function allows remote threat actors to pass specially designed data to the target application to gain access to potentially sensitive information on the system.
The flaw received a score of 4.6/10 on the CVSS scale.
Although the flaws can be exploited remotely by unauthenticated hackers, experts have not detected attempts to exploit them in real-world scenarios or some malware linked to this attack.
Updates are now available on official Mitsubishi platforms. For further reports on vulnerabilities, exploits, malware variants and computer security risks, it is recommended to enter the website of the International Institute of Cyber Security (IICS), as well as the official platforms of technology companies.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
