Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2021-20597 (GCVE-0-2021-20597)
Vulnerability from cvelistv5 – Published: 2021-08-06 00:00 – Updated: 2024-08-03 17:45
VLAI
EPSS
Summary
Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.
Severity
No CVSS data available.
CWE
- Insufficiently Protected Credentials
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU |
Affected:
Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior
Affected: Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions "11" and prior |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:45:44.727Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/vu/JVNVU98578731/index.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \"26\" and prior"
},
{
"status": "affected",
"version": "Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions \"11\" and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \"26\" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.\u003c/p\u003e"
}
],
"value": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \"26\" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Insufficiently Protected Credentials",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-24T07:50:28.720Z",
"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
"shortName": "Mitsubishi"
},
"references": [
{
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf"
},
{
"url": "https://jvn.jp/vu/JVNVU98578731/index.html"
},
{
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
"assignerShortName": "Mitsubishi",
"cveId": "CVE-2021-20597",
"datePublished": "2021-08-06T00:00:00.000Z",
"dateReserved": "2020-12-17T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:45:44.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2021-20597",
"date": "2026-05-31",
"epss": "0.00888",
"percentile": "0.75816"
},
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"66D3AC7B-50E0-47D5-B0D1-07329D724EFE\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B185323A-C9E3-48A0-AD28-DA7AC7846E18\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA81D5C7-46C8-4F0E-9550-D240DC0366F3\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C4BBE066-33C4-4410-85D3-4B77B3773330\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FB53D61-6C69-4A4A-92B1-C10D0B8F0EC9\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6F6304BE-DAEE-49AB-B0B1-CEE6878CBECE\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8218130C-4E7D-4FB9-976B-2351977C82D4\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"515BDC46-5A1C-4A94-816A-B4751BB1B58D\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A63D33D-302A-428C-986F-FC3F83CE9C86\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EA37F2FC-8F75-4FEA-882D-87AD5CC1558E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FFB42739-E503-44B2-A020-0DB2B8791A81\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"17AD5875-B7D7-498B-9484-23049753133E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3B1F532B-8EAF-4E66-9AF5-5EEFF5A0BC23\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0EC2594C-6067-40BA-B8B2-AEC9B9C7922F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2C03EA2-34BF-4F86-A19C-2818788E092B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA3FB3E1-D7D3-424B-A207-D3C6F4365D12\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \\\"26\\\" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions \\\"11\\\" and prior allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.\"}, {\"lang\": \"es\", \"value\": \"La vulnerabilidad de credenciales insuficientemente protegidas en los m\\u00f3dulos de CPU de seguridad de la serie MELSEC iQ-R de Mitsubishi Electric R08/16/32/120SFCPU, versiones de firmware \\\"26\\\" y anteriores, y en los m\\u00f3dulos de CPU de proceso SIL2 de la serie MELSEC iQ-R de Mitsubishi Electric R08/16/32/120PSFCPU, todas las versiones, permite que un atacante remoto no autenticado inicie sesi\\u00f3n en el objetivo de forma no autorizada mediante el olfateo del tr\\u00e1fico de red y la obtenci\\u00f3n de credenciales al registrar informaci\\u00f3n de usuario en el objetivo o al cambiar una contrase\\u00f1a\"}]",
"id": "CVE-2021-20597",
"lastModified": "2024-11-21T05:46:51.063",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"baseScore\": 9.1, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.2}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:N\", \"baseScore\": 6.4, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2021-08-06T17:15:07.140",
"references": "[{\"url\": \"https://jvn.jp/vu/JVNVU98578731/index.html\", \"source\": \"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01\", \"source\": \"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp\"}, {\"url\": \"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf\", \"source\": \"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://jvn.jp/vu/JVNVU98578731/index.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-522\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2021-20597\",\"sourceIdentifier\":\"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp\",\"published\":\"2021-08-06T17:15:07.140\",\"lastModified\":\"2024-11-21T05:46:51.063\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \\\"26\\\" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions \\\"11\\\" and prior allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad de credenciales insuficientemente protegidas en los m\u00f3dulos de CPU de seguridad de la serie MELSEC iQ-R de Mitsubishi Electric R08/16/32/120SFCPU, versiones de firmware \\\"26\\\" y anteriores, y en los m\u00f3dulos de CPU de proceso SIL2 de la serie MELSEC iQ-R de Mitsubishi Electric R08/16/32/120PSFCPU, todas las versiones, permite que un atacante remoto no autenticado inicie sesi\u00f3n en el objetivo de forma no autorizada mediante el olfateo del tr\u00e1fico de red y la obtenci\u00f3n de credenciales al registrar informaci\u00f3n de usuario en el objetivo o al cambiar una contrase\u00f1a\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:N\",\"baseScore\":6.4,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-522\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66D3AC7B-50E0-47D5-B0D1-07329D724EFE\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B185323A-C9E3-48A0-AD28-DA7AC7846E18\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA81D5C7-46C8-4F0E-9550-D240DC0366F3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4BBE066-33C4-4410-85D3-4B77B3773330\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FB53D61-6C69-4A4A-92B1-C10D0B8F0EC9\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F6304BE-DAEE-49AB-B0B1-CEE6878CBECE\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8218130C-4E7D-4FB9-976B-2351977C82D4\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"515BDC46-5A1C-4A94-816A-B4751BB1B58D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A63D33D-302A-428C-986F-FC3F83CE9C86\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA37F2FC-8F75-4FEA-882D-87AD5CC1558E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFB42739-E503-44B2-A020-0DB2B8791A81\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"17AD5875-B7D7-498B-9484-23049753133E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B1F532B-8EAF-4E66-9AF5-5EEFF5A0BC23\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0EC2594C-6067-40BA-B8B2-AEC9B9C7922F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2C03EA2-34BF-4F86-A19C-2818788E092B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA3FB3E1-D7D3-424B-A207-D3C6F4365D12\"}]}]}],\"references\":[{\"url\":\"https://jvn.jp/vu/JVNVU98578731/index.html\",\"source\":\"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01\",\"source\":\"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp\"},{\"url\":\"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf\",\"source\":\"Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://jvn.jp/vu/JVNVU98578731/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
}
}
FKIE_CVE-2021-20597
Vulnerability from fkie_nvd - Published: 2021-08-06 17:15 - Updated: 2024-11-21 05:46
Severity
Summary
Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "66D3AC7B-50E0-47D5-B0D1-07329D724EFE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B185323A-C9E3-48A0-AD28-DA7AC7846E18",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AA81D5C7-46C8-4F0E-9550-D240DC0366F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C4BBE066-33C4-4410-85D3-4B77B3773330",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7FB53D61-6C69-4A4A-92B1-C10D0B8F0EC9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6F6304BE-DAEE-49AB-B0B1-CEE6878CBECE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8218130C-4E7D-4FB9-976B-2351977C82D4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "515BDC46-5A1C-4A94-816A-B4751BB1B58D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5A63D33D-302A-428C-986F-FC3F83CE9C86",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EA37F2FC-8F75-4FEA-882D-87AD5CC1558E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FFB42739-E503-44B2-A020-0DB2B8791A81",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17AD5875-B7D7-498B-9484-23049753133E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3B1F532B-8EAF-4E66-9AF5-5EEFF5A0BC23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0EC2594C-6067-40BA-B8B2-AEC9B9C7922F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B2C03EA2-34BF-4F86-A19C-2818788E092B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CA3FB3E1-D7D3-424B-A207-D3C6F4365D12",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \"26\" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password."
},
{
"lang": "es",
"value": "La vulnerabilidad de credenciales insuficientemente protegidas en los m\u00f3dulos de CPU de seguridad de la serie MELSEC iQ-R de Mitsubishi Electric R08/16/32/120SFCPU, versiones de firmware \"26\" y anteriores, y en los m\u00f3dulos de CPU de proceso SIL2 de la serie MELSEC iQ-R de Mitsubishi Electric R08/16/32/120PSFCPU, todas las versiones, permite que un atacante remoto no autenticado inicie sesi\u00f3n en el objetivo de forma no autorizada mediante el olfateo del tr\u00e1fico de red y la obtenci\u00f3n de credenciales al registrar informaci\u00f3n de usuario en el objetivo o al cambiar una contrase\u00f1a"
}
],
"id": "CVE-2021-20597",
"lastModified": "2024-11-21T05:46:51.063",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-08-06T17:15:07.140",
"references": [
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/vu/JVNVU98578731/index.html"
},
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01"
},
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/vu/JVNVU98578731/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf"
}
],
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-522"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-46VR-P4G8-F826
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-10-14 19:00
VLAI
Details
Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2021-20597"
],
"database_specific": {
"cwe_ids": [
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-06T17:15:00Z",
"severity": "CRITICAL"
},
"details": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.",
"id": "GHSA-46vr-p4g8-f826",
"modified": "2022-10-14T19:00:17Z",
"published": "2022-05-24T19:10:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20597"
},
{
"type": "WEB",
"url": "https://jvn.jp/vu/JVNVU98578731/index.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GSD-2021-20597
Vulnerability from gsd - Updated: 2023-12-13 01:23Details
Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2021-20597",
"description": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.",
"id": "GSD-2021-20597"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2021-20597"
],
"details": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \"26\" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.",
"id": "GSD-2021-20597",
"modified": "2023-12-13T01:23:12.635810Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"ID": "CVE-2021-20597",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU; Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU",
"version": {
"version_data": [
{
"version_value": "Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \"26\" and prior"
},
{
"version_value": "Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \"26\" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Insufficiently Protected Credentials"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf",
"refsource": "MISC",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf"
},
{
"name": "https://jvn.jp/vu/JVNVU98578731/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/vu/JVNVU98578731/index.html"
},
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"ID": "CVE-2021-20597"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions \"26\" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-522"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jvn.jp/vu/JVNVU98578731/index.html",
"refsource": "MISC",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/vu/JVNVU98578731/index.html"
},
{
"name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf"
},
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01",
"refsource": "MISC",
"tags": [],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2
}
},
"lastModifiedDate": "2022-10-14T18:15Z",
"publishedDate": "2021-08-06T17:15Z"
}
}
}
ICSA-21-250-01
Vulnerability from csaf_cisa - Published: 2021-09-07 06:00 - Updated: 2024-04-18 06:00Summary
Mitsubishi Electric MELSEC iQ-R Series
Notes
Legal Notice: All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation: Successful exploitation of these vulnerabilities could allow a remote attacker unauthorized access to legitimate usernames, CPU module access, or the ability to deny access to legitimate users.
Critical infrastructure sectors: Critical Manufacturing
Countries/areas deployed: Worldwide
Company headquarters location: Japan
Recommended Practices: CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices: CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices: CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.
Recommended Practices: Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.
Recommended Practices: Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.
Recommended Practices: No known public exploitation specifically targeting this these vulnerabilities has been reported to CISA at this time.
5.9 (Medium)
Affected products
Known affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R08SFCPU Firmware: <=26
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R08SFCPU Firmware
|
<=26 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R16SFCPU Firmware: <=26
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R16SFCPU Firmware
|
<=26 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R32SFCPU Firmware: <=26
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R32SFCPU Firmware
|
<=26 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R120SFCPU Firmware: <=26
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R120SFCPU Firmware
|
<=26 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R08PSFCPU Firmware: <=11
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R08PSFCPU Firmware
|
<=11 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R16PSFCPU Firmware: <=11
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R16PSFCPU Firmware
|
<=11 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R32PSFCPU Firmware: <=11
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R32PSFCPU Firmware
|
<=11 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R120PSFCPU Firmware: <=11
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R120PSFCPU Firmware
|
<=11 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
7.4 (High)
Affected products
Known affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R08SFCPU Firmware: <=26
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R08SFCPU Firmware
|
<=26 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R16SFCPU Firmware: <=26
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R16SFCPU Firmware
|
<=26 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R32SFCPU Firmware: <=26
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R32SFCPU Firmware
|
<=26 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R120SFCPU Firmware: <=26
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R120SFCPU Firmware
|
<=26 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R08PSFCPU Firmware: <=11
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R08PSFCPU Firmware
|
<=11 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R16PSFCPU Firmware: <=11
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R16PSFCPU Firmware
|
<=11 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R32PSFCPU Firmware: <=11
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R32PSFCPU Firmware
|
<=11 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R120PSFCPU Firmware: <=11
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R120PSFCPU Firmware
|
<=11 |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
CWE-645
- Overly Restrictive Account Lockout Mechanism
Affected products
Known affected
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R08SFCPU: vers:all/*
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R08SFCPU
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R16SFCPU: vers:all/*
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R16SFCPU
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R32SFCPU: vers:all/*
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R32SFCPU
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R120SFCPU: vers:all/*
Mitsubishi Electric Corporation / MELSEC iQ-R series Safety CPU R120SFCPU
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R08PSFCPU: vers:all/*
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R08PSFCPU
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R16PSFCPU: vers:all/*
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R16PSFCPU
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R32PSFCPU: vers:all/*
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R32PSFCPU
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
|
|
Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R120PSFCPU: vers:all/*
Mitsubishi Electric Corporation / MELSEC iQ-R series SIL2 Process CPU R120PSFCPU
|
vers:all/* |
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
Mitigation
fix
Mitigation
fix
Mitigation
fix
|
References
17 references
Acknowledgments
Nozomi Networks Labs
Ivan Speziale
{
"document": {
"acknowledgments": [
{
"names": [
"Ivan Speziale"
],
"organization": "Nozomi Networks Labs",
"summary": "reporting these vulnerabilities to CISA"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "Successful exploitation of these vulnerabilities could allow a remote attacker unauthorized access to legitimate usernames, CPU module access, or the ability to deny access to legitimate users.",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Critical Manufacturing",
"title": "Critical infrastructure sectors"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Japan",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "No known public exploitation specifically targeting this these vulnerabilities has been reported to CISA at this time.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "central@cisa.dhs.gov",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-21-250-01 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-250-01.json"
},
{
"category": "self",
"summary": "ICSA Advisory ICSA-21-250-01 - Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-250-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/topics/industrial-control-systems"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
},
{
"category": "external",
"summary": "Recommended Practices",
"url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
}
],
"title": "Mitsubishi Electric MELSEC iQ-R Series",
"tracking": {
"current_release_date": "2024-04-18T06:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-21-250-01",
"initial_release_date": "2021-09-07T06:00:00.000000Z",
"revision_history": [
{
"date": "2021-09-07T06:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "Initial Publication"
},
{
"date": "2022-10-13T06:00:00.000000Z",
"legacy_version": "Update A",
"number": "2",
"summary": "Update A - Added new fixed version"
},
{
"date": "2024-04-18T06:00:00.000000Z",
"legacy_version": "Update B",
"number": "3",
"summary": "Update B - Added new fixed version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=26",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R08SFCPU Firmware: \u003c=26",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series Safety CPU R08SFCPU Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=26",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R16SFCPU Firmware: \u003c=26",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series Safety CPU R16SFCPU Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=26",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R32SFCPU Firmware: \u003c=26",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series Safety CPU R32SFCPU Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=26",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R120SFCPU Firmware: \u003c=26",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series Safety CPU R120SFCPU Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R08SFCPU: vers:all/*",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series Safety CPU R08SFCPU"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R16SFCPU: vers:all/*",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series Safety CPU R16SFCPU"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R32SFCPU: vers:all/*",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series Safety CPU R32SFCPU"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R120SFCPU: vers:all/*",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series Safety CPU R120SFCPU"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=11",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R08PSFCPU Firmware: \u003c=11",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series SIL2 Process CPU R08PSFCPU Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=11",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R16PSFCPU Firmware: \u003c=11",
"product_id": "CSAFPID-0010"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series SIL2 Process CPU R16PSFCPU Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=11",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R32PSFCPU Firmware: \u003c=11",
"product_id": "CSAFPID-0011"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series SIL2 Process CPU R32PSFCPU Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=11",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R120PSFCPU Firmware: \u003c=11",
"product_id": "CSAFPID-0012"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series SIL2 Process CPU R120PSFCPU Firmware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R08PSFCPU: vers:all/*",
"product_id": "CSAFPID-0013"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series SIL2 Process CPU R08PSFCPU"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R16PSFCPU: vers:all/*",
"product_id": "CSAFPID-0014"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series SIL2 Process CPU R16PSFCPU"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R32PSFCPU: vers:all/*",
"product_id": "CSAFPID-0015"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series SIL2 Process CPU R32PSFCPU"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:all/*",
"product": {
"name": "Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R120PSFCPU: vers:all/*",
"product_id": "CSAFPID-0016"
}
}
],
"category": "product_name",
"name": "MELSEC iQ-R series SIL2 Process CPU R120PSFCPU"
}
],
"category": "vendor",
"name": "Mitsubishi Electric Corporation"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-20594",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "summary",
"text": "A remote attacker can leverage a brute-force attack to acquire legitimate usernames registered in the module.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20594"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Users of the affected products and versions may take measures through mitigations and workarounds. Mitsubishi Electric has released the fixed versions for CVE-2021-20594 and CVE-2021-20597 as shown below, but updating the product to the fixed version is not available.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU:Firmware versions \"27\" or later",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU:Firmware versions \"12\" or later",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "Mitsubishi Electric recommends users take the following mitigation measures to minimize the risk of exploiting these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "Use within a LAN and block access from untrusted networks and hosts through firewalls.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "Use the IP filter function to restrict the accessible IP addresses. MELSEC iQ-R Ethernet User\u0027s Manual (Application) 1.13 Security \"IP filter\"",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
],
"url": "https://www.mitsubishifa.co.th/files/dl/plc/sh081257eng/sh081257engs.pdf"
},
{
"category": "mitigation",
"details": "Additional information about these vulnerabilities or Mitsubishi Electric\u0027s compensating control is available by contacting a Mitsubishi Electric representative.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
],
"url": "https://www.mitsubishielectric.com/fa/support/index.html"
},
{
"category": "mitigation",
"details": "Users should refer to Mitsubishi Electric advisories 2021-008, 2021-009, and 2021-010 for further details.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-008_en.pdf"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
}
]
},
{
"cve": "CVE-2021-20597",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"notes": [
{
"category": "summary",
"text": "A remote attacker could obtain unprotected credentials by sniffing network traffic.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20597"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Users of the affected products and versions may take measures through mitigations and workarounds. Mitsubishi Electric has released the fixed versions for CVE-2021-20594 and CVE-2021-20597 as shown below, but updating the product to the fixed version is not available.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU:Firmware versions \"27\" or later",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU:Firmware versions \"12\" or later",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "Mitsubishi Electric recommends users take the following mitigation measures to minimize the risk of exploiting these vulnerabilities:",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "Use within a LAN and block access from untrusted networks and hosts through firewalls.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
},
{
"category": "mitigation",
"details": "Use the IP filter function to restrict the accessible IP addresses. MELSEC iQ-R Ethernet User\u0027s Manual (Application) 1.13 Security \"IP filter\"",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
],
"url": "https://www.mitsubishifa.co.th/files/dl/plc/sh081257eng/sh081257engs.pdf"
},
{
"category": "mitigation",
"details": "Register user information or change the password via USB. If you have already registered user information or changed the user\u0027s password via the network, change the password once via USB. This mitigation is applicable to CVE-2021-20597",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
],
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20597"
},
{
"category": "mitigation",
"details": "Additional information about these vulnerabilities or Mitsubishi Electric\u0027s compensating control is available by contacting a Mitsubishi Electric representative.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
],
"url": "https://www.mitsubishielectric.com/fa/support/index.html"
},
{
"category": "mitigation",
"details": "Users should refer to Mitsubishi Electric advisories 2021-008, 2021-009, and 2021-010 for further details.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-008_en.pdf"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0009",
"CSAFPID-0010",
"CSAFPID-0011",
"CSAFPID-0012"
]
}
]
},
{
"cve": "CVE-2021-20598",
"cwe": {
"id": "CWE-645",
"name": "Overly Restrictive Account Lockout Mechanism"
},
"notes": [
{
"category": "summary",
"text": "A remote attacker could lock out a legitimate user by continually attempting to login with a known username and incorrect passwords.",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-20598"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
}
],
"remediations": [
{
"category": "mitigation",
"details": "MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU:Firmware versions \"27\" or later",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
},
{
"category": "mitigation",
"details": "MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU:Firmware versions \"12\" or later",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
},
{
"category": "mitigation",
"details": "Mitsubishi Electric recommends users take the following mitigation measures to minimize the risk of exploiting these vulnerabilities:",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
},
{
"category": "mitigation",
"details": "Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
},
{
"category": "mitigation",
"details": "Use within a LAN and block access from untrusted networks and hosts through firewalls.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
},
{
"category": "mitigation",
"details": "Use the IP filter function to restrict the accessible IP addresses. MELSEC iQ-R Ethernet User\u0027s Manual (Application) 1.13 Security \"IP filter\"",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
],
"url": "https://www.mitsubishifa.co.th/files/dl/plc/sh081257eng/sh081257engs.pdf"
},
{
"category": "mitigation",
"details": "Additional information about these vulnerabilities or Mitsubishi Electric\u0027s compensating control is available by contacting a Mitsubishi Electric representative.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
],
"url": "https://www.mitsubishielectric.com/fa/support/index.html"
},
{
"category": "mitigation",
"details": "Users should refer to Mitsubishi Electric advisories 2021-008, 2021-009, and 2021-010 for further details.",
"product_ids": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-008_en.pdf"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0013",
"CSAFPID-0014",
"CSAFPID-0015",
"CSAFPID-0016"
]
}
]
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…