Mitsubishi Electric MELQIC IU1 up to 1.0.7 TCP Crafted Packet argument injection

Summaryinfo

A vulnerability labeled as critical has been found in Mitsubishi Electric MELQIC IU1 up to 1.0.7. This impacts an unknown function of the component TCP Handler. The manipulation as part of Crafted Packet results in argument injection. This vulnerability is cataloged as CVE-2020-5546. The attack must originate from the local network. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Mitsubishi Electric MELQIC IU1 up to 1.0.7. Affected is an unknown part of the component TCP Handler. The manipulation as part of a Crafted Packet leads to a argument injection vulnerability. CWE is classifying the issue as CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier allows an attacker on the same network segment to stop the network functions or execute malware via a specially crafted packet.

The weakness was shared 03/16/2020. This vulnerability is traded as CVE-2020-5546 since 01/06/2020. The exploitability is told to be easy. The attack needs to be done within the local network. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-151645, VDB-151643, VDB-151642 and VDB-151641 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Mitsubishi Electric

Name

• MELQIC IU1

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion