CVE-2020-16850

highpriority · track · 31EPSS 0.021 · 82 %ileEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
2.14% (82nd) EPSS
CVSS 7.8 · high
Is it mine?
85 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixediQ-R series R00CPUcisa_csaf_ot

    iQ-R series R00CPU: Version 21 or later

  • FixediQ-R series R01CPUcisa_csaf_ot

    iQ-R series R01CPU: Version 21 or later

  • FixediQ-R series R04CPUcisa_csaf_ot

    iQ-R series R04CPU: Version 53 or later

  • FixediQ-R series R04ENCPUcisa_csaf_ot

    iQ-R series R04ENCPU: Version 53 or later

  • FixediQ-R series R08CPUcisa_csaf_ot

    iQ-R series R08CPU: Version 53 or later

  • FixediQ-R series R08ENCPUcisa_csaf_ot

    iQ-R series R08ENCPU: Version 53 or later

  • FixediQ-R series R08FCPUcisa_csaf_ot

    iQ-R series R08FCPU: Version 23 or later

  • FixediQ-R series R08PCPUcisa_csaf_ot

    iQ-R series R08PCPU: Version 26 or later

  • FixediQ-R series R120CPUcisa_csaf_ot

    iQ-R series R120CPU: Version 53 or later

  • FixediQ-R series R120ENCPUcisa_csaf_ot

    iQ-R series R120ENCPU: Version 53 or later

  • FixediQ-R series R120FCPUcisa_csaf_ot

    iQ-R series R120FCPU: Version 23 or later

  • FixediQ-R series R120PCPUcisa_csaf_ot

    iQ-R series R120PCPU: Version 26 or later

  • FixediQ-R series R16CPUcisa_csaf_ot

    iQ-R series R16CPU: Version 53 or later

  • FixediQ-R series R16ENCPUcisa_csaf_ot

    iQ-R series R16ENCPU: Version 53 or later

  • FixediQ-R series R16FCPUcisa_csaf_ot

    iQ-R series R16FCPU: Version 23 or later

  • FixediQ-R series R16MTCPU Operating system softwarecisa_csaf_ot

    iQ-R series R16MTCPU Operating system software: Version 22 or later

  • FixediQ-R series R16PCPUcisa_csaf_ot

    iQ-R series R16PCPU: Version 26 or later

  • FixediQ-R series R32CPUcisa_csaf_ot

    iQ-R series R32CPU: Version 53 or later

  • FixediQ-R series R32ENCPUcisa_csaf_ot

    iQ-R series R32ENCPU: Version 53 or later

  • FixediQ-R series R32FCPUcisa_csaf_ot

    iQ-R series R32FCPU: Version 23 or later

  • FixediQ-R series R32MTCPU Operating system softwarecisa_csaf_ot

    iQ-R series R32MTCPU Operating system software: Version 22 or later

  • FixediQ-R series R32PCPUcisa_csaf_ot

    iQ-R series R32PCPU: Version 26 or later

  • FixediQ-R series R64MTCPU Operating system softwarecisa_csaf_ot

    iQ-R series R64MTCPU Operating system software: Version 22 or later

  • MitigationiQ-R series R00CPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R01CPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R04CPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R04ENCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R08CPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R08ENCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R08FCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R08PCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R120CPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R120ENCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R120FCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R120PCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R16CPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R16ENCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R16FCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R16MTCPU Operating system softwarecisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R16PCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R32CPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R32ENCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R32FCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R32MTCPU Operating system softwarecisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R32PCPUcisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

  • MitigationiQ-R series R64MTCPU Operating system softwarecisa_csaf_ot

    Mitsubishi Electric recommends that customers take the following mitigation measures to minimize the risk of exploiting thisvulnerability:

02

cvss

Technical severity, 0–10. One row per scoring source.

8.6
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–8.6

v2.07.8highAV:N/AC:L/Au:N/C:N/I:N/A:Cprimary · NVD / NIST USexploitability 10 · impact 6.9
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 3.6
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · CISA US
v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USprimaryCWE-400USprimaryCWE-400USCWE-400US
04

affected products (85)

Products and version ranges known to be affected.

showing 20 of 85
05

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-20-282-02Mitsubishi Electric MELSEC iQ-R Series (Update D)2020-11-19icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could cause a denial-of-service condition.

06

also known as (4)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otNVDCVE.orgMITRE
published 2020-11-30modified 2026-06-17
09

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan