CVE-2020-5595

Vulnerability

The TCP/IP function in CoreOS versions -Y and earlier on Mitsubishi Electric GOT2000 series (GT27, GT25, and GT23 models) contains a buffer overflow vulnerability (CWE-119). An attacker can trigger it by sending a specially crafted network packet, causing out-of-bounds memory operations.

Exploitation

An attacker needs only network reachability to the affected device — no authentication or user interaction is required. The attacker crafts a malicious TCP/IP packet and transmits it to the GOT2000’s network interface, which the vulnerable stack processes, leading to a buffer overflow.

Impact

Successful exploitation can stop the device’s network functions (denial of service) or allow the attacker to execute a malicious program on the device. The compromise scope is the device itself, potentially enabling further network attacks.

Mitigation

Mitigation requires updating CoreOS to version Z or later. Users must obtain MELSOFT GT Designer3(2000) 1.240A or later, create a CoreOS image with version Z on an SD card, and update the device. If an update is not immediately possible, restrict access from untrusted networks or hosts as a workaround. [1]