Read the docs
TI-2020-04497 Aliases CVE-2020-5527GHSA-5jq2-477f-97vj

Uncontrolled resource consumption in Mitsubishi Electric Corporation MELSOFT transmission…

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

When MELSOFT transmission port (UDP/IP) of Mitsubishi Electric MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) receives massive amount of data via unspecified vectors, resource consumption occurs and the port does not process the data properly. As a result, it may fall into a denial-of-service (DoS) condition. The vendor states this vulnerability only affects Ethernet communication functions.

Why it matters now

EPSS 0.01365 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Mitsubishi Electric CorporationMELSOFT transmission port (UDP/IP) of multiple Mitsubishi Electric MELSEC seriesMELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions)—No fix listedCNA
  • MELSOFT transmission port (UDP/IP) of multiple Mitsubishi Electric MELSEC series VendorMitsubishi Electric Corporation Affected MELSEC iQ-R series (all versions), MELSEC iQ-F series (all versions), MELSEC Q series (all versions), MELSEC L series (all versions), and MELSEC F series (all versions) Fixed in — No fix listed CNA

CPE configurations NVD · 92

CPEVersionsRoleVendor
cpe:2.3:o:mitsubishielectric:cr800-q_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:cr800-q:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:fx3g_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:fx3g:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:fx3gc_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:fx3gc:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:fx3s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:fx3s:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:fx3u_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:fx3u:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
Show 82 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:mitsubishielectric:fx3uc_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:fx3uc:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:fx5u_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:fx5u:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:fx5uc_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:fx5uc:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:fx5uj_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:fx5uj:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l02cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l02cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l02cpu-p_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l02cpu-p:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l02scpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l02scpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l02scpu-p_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l02scpu-p:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l06cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l06cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l06cpu-p_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l06cpu-p:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l26cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l26cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l26cpu-bt_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l26cpu-bt:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l26cpu-p_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l26cpu-p:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:l26cpu-pbt_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:l26cpu-pbt:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q02phcpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q02phcpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q06phcpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q06phcpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q12dccpu-v_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q12dccpu-v:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q12phcpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q12phcpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q12prhcpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q12prhcpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q172dscpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q172dscpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q173dscpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q173dscpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q173nccpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q173nccpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q24dhccpu-ls_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q24dhccpu-ls:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q24dhccpu-v_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q24dhccpu-v:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q24dhccpu-vg2_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q24dhccpu-vg2:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q25phcpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q25phcpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q25prhcpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q25prhcpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:q26dhccpu-ls_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:q26dhccpu-ls:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r00cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r00cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r01cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r01cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r02cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r02cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r04cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r04cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r04encpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r04encpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r08cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r08cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r08encpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r08encpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r120cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r120cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r120encpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r120encpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r16cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r16cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r16encpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r16encpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r32cpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r32cpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.
cpe:2.3:o:mitsubishielectric:r32encpu_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableMitsubishi Electric Europe B.V.
cpe:2.3:h:mitsubishielectric:r32encpu:-:*:*:*:*:*:*:*not specified by NVDRunning onMitsubishi Electric Europe B.V.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5527
  2. 2026-10-03 Alias added: GHSA-5jq2-477f-97vj

References

  • TI-2022-14737 Deserialization of untrusted data in Mitsubishi Electric Corporation GENESIS64 CVSS 3.1CRITICAL 9.8
  • TI-2022-19113 Authentication Bypass Vulnerability in Web Server Function on MELSEC Series CVSS 3.1CRITICAL 9.1
  • TI-2023-01345 Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module CVSS 3.1CRITICAL 10.0
  • TI-2023-06346 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')… CVSS 3.1CRITICAL 9.8
  • TI-2023-03131 Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series CVSS 3.1CRITICAL 9.8
  • TI-2021-03821 Memory corruption in Mitsubishi Electric Corporation CPU Module Logging Configuration Tool CVSS 3.1CRITICAL 9.8
See all 151 →

Sources