PT-2021-14060 · Mitsubishi · Mitsubishi Electric Fa Engineering

Dliangfun · Published 2021-02-19 · Updated 2025-06-13 · CVE-2021-20587

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Mitsubishi Electric FA Engineering Software versions prior to the fixed version

Description: A heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software allows a remote unauthenticated attacker to cause a DoS condition of the software products, and possibly to execute a malicious program on the personal computer running the software products, by spoofing MELSEC, GOT or FREQROL and returning crafted reply packets.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

CVE-2021-20587

Affected Products

Mitsubishi Electric Fa Engineering

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2021-20587 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20587 · Vendor Advisory
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-021_en.pdf · Vendor Advisory
• https://mitsubishielectric.com/psirt/vulnerability/pdf/2020-021_en.pdf · Vendor Advisory
• https://t.me/cvenotify/30127 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-049-02 · Note
• https://t.me/cvenotify/10653 · Telegram Post
• https://jvn.jp/vu/JVNVU92330101 · Note
• https://jvn.jp/vu/JVNVU92330101/index.html · Note
• https://t.me/cvenotify/125563 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-21-049-02 · Note
• https://t.me/cibsecurity/23887 · Telegram Post