PT-2021-14059 · Mitsubishi · Assista+2

Published 2021-01-29 · Updated 2022-07-12 · CVE-2021-20586

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: MELFA FR Series versions all versions MELFA CR Series versions all versions ASSISTA versions all versions

Description: A resource management error in the robot controllers allows a remote unauthenticated attacker to cause a Denial of Service (DoS) of the execution of the robot program and the Ethernet communication by sending a large amount of packets in burst over a short period of time. As a result of the DoS, an error may occur, requiring a reset to recover.

Recommendations: For MELFA FR Series, consider implementing rate limiting on incoming packets to prevent excessive bursts. For MELFA CR Series, restrict access to the Ethernet communication to minimize the risk of exploitation. For ASSISTA, as a temporary workaround, consider disabling the Ethernet communication until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2021-20586

Affected Products

Assista

Melfa Cr Series

Melfa Fr Series

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-20586 · Security Note
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-019_en.pdf · Vendor Advisory
• https://t.me/cibsecurity/22845 · Telegram Post