CVE-2020-5603
📋 TL;DR
This vulnerability allows an attacker to cause denial of service (DoS) conditions in multiple Mitsubishi Electric industrial control software products by exploiting uncontrolled resource consumption. Attackers can disrupt critical industrial operations by exhausting system resources through unspecified vectors. Organizations using affected Mitsubishi Electric FA engineering software are at risk.
💻 Affected Systems
- CPU Module Logging Configuration Tool
- CW Configurator
- EM Software Development Kit (EM Configurator)
- GT Designer3 (GOT2000)
- GX LogViewer
- GX Works2
- GX Works3
- M_CommDTM-HART
- M_CommDTM-IO-Link
- MELFA-Works
- MELSEC-L Flexible High-Speed I/O Control Module Configuration Tool
- MELSOFT FieldDeviceConfigurator
- MELSOFT iQ AppPortal
- MELSOFT Navigator
- MI Configurator
- Motion Control Setting
- MR Configurator2
- MT Works2
- RT ToolBox2
- RT ToolBox3
📦 What is this software?
Cpu Module Logging Configuration Tool by Mitsubishielectric
View all CVEs affecting Cpu Module Logging Configuration Tool →
Cw Configurator by Mitsubishielectric
Em Configurator by Mitsubishielectric
Gt Designer3 by Mitsubishielectric
Gx Logviewer by Mitsubishielectric
Gx Works2 by Mitsubishielectric
Gx Works3 by Mitsubishielectric
M Commdtm Hart by Mitsubishielectric
M Commdtm Io Link by Mitsubishielectric
Melfa Works by Mitsubishielectric
Melsec L Flexible High Speed I\/o Control Module Configuration Tool by Mitsubishielectric
View all CVEs affecting Melsec L Flexible High Speed I\/o Control Module Configuration Tool →
Melsoft Fielddeviceconfigurator by Mitsubishielectric
Melsoft Iq Appportal by Mitsubishielectric
Melsoft Navigator by Mitsubishielectric
Mi Configurator by Mitsubishielectric
Motion Control Setting by Mitsubishielectric
Mr Configurator2 by Mitsubishielectric
Mt Works2 by Mitsubishielectric
Rt Toolbox2 by Mitsubishielectric
Rt Toolbox3 by Mitsubishielectric
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability leading to production stoppage, safety system failures, and significant operational disruption in industrial environments.
Likely Case
Service degradation or temporary unavailability of engineering software, disrupting configuration, monitoring, and maintenance activities.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially affecting only non-critical systems.
🎯 Exploit Status
The advisory mentions 'unspecified vectors' but indicates unauthenticated exploitation is possible. No public exploit code has been identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions newer than those listed in the affected versions section
Vendor Advisory: https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-004_en.pdf
Restart Required: Yes
Instructions:
1. Download updated software versions from Mitsubishi Electric's official website. 2. Install updates following vendor instructions. 3. Restart affected systems. 4. Verify successful installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks to prevent remote exploitation.
Access Control Restrictions
allImplement strict access controls to limit who can interact with vulnerable software.
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from potential attackers
- Apply strict access controls and monitor for unusual resource consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check software version against affected versions list in vendor advisory. Use 'About' or version information in each application.Check Version:
Check application 'About' dialog or use Windows 'Programs and Features' to view installed versionVerify Fix Applied:
Verify installed version is newer than affected versions listed in the advisory. Check vendor documentation for specific version numbers.📡 Detection & Monitoring
Log Indicators:
- Unusual resource consumption patterns
- Application crashes or hangs
- High CPU/memory usage in engineering software
Network Indicators:
- Unexpected network connections to engineering software ports
- Traffic patterns suggesting resource exhaustion attempts
SIEM Query:
Search for: (event_source contains 'Mitsubishi' OR process_name contains affected software names) AND (event_type contains 'crash' OR resource_usage > threshold)