Skip to content
Fencer Intel
high 7.5

CVE-2020-16850 json

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted p…

published 5y ago modified 4mo ago also EUVD-2020-8808

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.1%
EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2.

Is CVE-2020-16850 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-282-02 updated cvss 8.6

Mitsubishi Electric MELSEC iQ-R Series (Update D)

  • Mitsubishi Electric iQ-R series R00CPU <=20 Mitsubishi Electric iQ-R series R01CPU <=20 Mitsubishi Electric iQ-R series R04CPU <=52 Mitsubishi Electric iQ-R series R04ENCPU <=52 Mitsubishi Electric iQ-R series R08CPU <=52 Mitsubishi Electric iQ-R series R08ENCPU <=52
    +17 more products
    Mitsubishi Electric iQ-R series R08FCPU <=22 Mitsubishi Electric iQ-R series R08PCPU <=25 Mitsubishi Electric iQ-R series R16CPU <=52 Mitsubishi Electric iQ-R series R16ENCPU <=52 Mitsubishi Electric iQ-R series R16FCPU <=22 Mitsubishi Electric iQ-R series R16MTCPU Operating system software <=21 Mitsubishi Electric iQ-R series R16PCPU <=25 Mitsubishi Electric iQ-R series R32CPU <=52 Mitsubishi Electric iQ-R series R32ENCPU <=52 Mitsubishi Electric iQ-R series R32FCPU <=22 Mitsubishi Electric iQ-R series R32MTCPU Operating system software <=21 Mitsubishi Electric iQ-R series R32PCPU <=25 Mitsubishi Electric iQ-R series R64MTCPU Operating system software <=21 Mitsubishi Electric iQ-R series R120CPU <=52 Mitsubishi Electric iQ-R series R120ENCPU <=52 Mitsubishi Electric iQ-R series R120FCPU <=22 Mitsubishi Electric iQ-R series R120PCPU <=25
    affected: vendor fix, mitigation “Mitsubishi Electric recommends that customers update to the following:” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.14% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.