CVE-2020-16850: Mitsubishielectric r00cpu Firmware

High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days.

Mitsubishi MELSEC iQ-R Series PLCs with firmware 49 allow an unauthenticated attacker to halt the industrial process by sending a crafted packet over the network. This denial of service attack exposes Improper Input Validation. After halting, physical access to the PLC is required in order to restore production, and the device state is lost. This is related to R04CPU, RJ71GF11-T2, R04CPU, and RJ71GF11-T2.

Affected products

• Mitsubishielectric r00cpu Firmware: up to and including 20
• Mitsubishielectric r01cpu Firmware: up to and including 20
• Mitsubishielectric r02cpu Firmware: up to and including 20
• Mitsubishielectric r04cpu Firmware: up to and including 52
• Mitsubishielectric r08cpu Firmware: up to and including 52
• Mitsubishielectric r08pcpu Firmware: any version
• Mitsubishielectric r08sfcpu Firmware: up to and including 22
• Mitsubishielectric r120cpu Firmware: up to and including 52
• Mitsubishielectric r120pcpu Firmware: any version
• Mitsubishielectric r120sfcpu Firmware: up to and including 22
• Mitsubishielectric r16cpu Firmware: up to and including 52
• Mitsubishielectric r16mtcpu Firmware: any version
• Mitsubishielectric r16pcpu Firmware: any version
• Mitsubishielectric r16sfcpu Firmware: up to and including 22
• Mitsubishielectric r32cpu Firmware: up to and including 52
• Mitsubishielectric r32mtcpu Firmware: any version
• Mitsubishielectric r32pcpu Firmware: any version
• Mitsubishielectric r32sfcpu Firmware: up to and including 22
• Mitsubishielectric r64mtcpu Firmware: any version

Published 2020-11-30. Last modified 2026-06-17.