CVE-2020-5596

Vulnerability

CVE-2020-5596 is a session fixation vulnerability (CWE-384) in the TCP/IP function of the CoreOS firmware on Mitsubishi Electric GOT2000 series HMI models GT27, GT25, and GT23 running CoreOS version -Y and earlier [1]. The flaw lies in how the session management handles authentication tokens, allowing reuse of unchanging session identifiers across connections.

Exploitation

An attacker on the network can craft a specially designed TCP/IP packet that establishes a new session with a known identifier and tricks a legitimate user or device into authenticating to that session [1]. No prior authentication is required, but the attacker must be able to inject packets into the network segment reachable by the GOT2000 unit.

Impact

Successful exploitation enables the attacker to hijack an active session, potentially stopping the network functions of the GOT2000 or executing a malicious program on the device [1]. This can lead to denial of service (DoS) and arbitrary code execution within the context of the CoreOS firmware.

Mitigation

Mitsubishi Electric has released the fix in CoreOS version Z and later, which is available via MELSOFT GT Designer3(2000) version 1.240A and later [1]. Users should update the CoreOS by following the vendor's instructions, and as a workaround restrict network access from untrusted hosts or networks to reduce exposure [1].