CVE-2020-5544

Vulnerability

A null pointer dereference vulnerability exists in the TCP function included in the firmware of Mitsubishi Electric MELQIC IU1 series IU1-1M20-D firmware version 1.0.7 and earlier. This vulnerability can be triggered without any special configuration or authentication.

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted packet to the target device over the network. No prior authentication or user interaction is required. The attacker only needs network access to the device.

Impact

Successful exploitation can lead to a denial of service by stopping the network functions of the device, or it may allow the attacker to execute malware on the device, potentially leading to full compromise.

Mitigation

Mitsubishi Electric has released firmware version 1.08 or later to fix this vulnerability. The update should be applied using IU Configuration Tool version 1.04 or later. As a workaround, restricting network access from untrusted hosts and networks via a firewall can mitigate the risk until the update is applied [1].