What’s Vulnerable › Vulnerabilities

CVE-2020-5657

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-02 · updated 2026-06-17
• Weakness: CWE-88

Description

Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in TCP/IP function included in the firmware of MELSEC iQ-R series (RJ71EIP91 EtherNet/IP Network Interface Module First 2 digits of serial number are '02' or before, RJ71PN92 PROFINET IO Controller Module First 2 digits of serial number are '01' or before, RD81DL96 High Speed Data Logger Module First 2 digits of serial number are '08' or before, RD81MES96N MES Interface Module First 2 digits of serial number are '04' or before, and RD81OPC96 OPC UA Server Module First 2 digits of serial number are '04' or before) allows unauthenticated attackers on adjacent network to stop the network functions of the products via a specially crafted packet.

Affected products

• Mitsubishielectric Melsec Iq-Rd81Dl96 Firmware: all versions
• Mitsubishielectric Melsec Iq-Rd81Mes96N Firmware: all versions
• Mitsubishielectric Melsec Iq-Rd81Opc96 Firmware: all versions
• Mitsubishielectric Melsec Iq-Rj71Eip91 Firmware: all versions
• Mitsubishielectric Melsec Iq-Rj71Pn92 Firmware: all versions

References

• https://jvn.jp/vu/JVNVU92513419/index.html
• https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf
• https://jvn.jp/vu/JVNVU92513419/index.html
• https://www.mitsubishielectric.co.jp/psirt/vulnerability/pdf/2020-012.pdf
• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-012_en.pdf

Get alerted when CVE-2020-5657 or the next vulnerability affects your stack