PT-2021-14067 · Mitsubishi · Melsec-F Series Fx3U-Enet-P502+1

Published 2021-07-22 · Updated 2021-08-02 · CVE-2021-20596

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: MELSEC-F Series FX3U-ENET firmware versions 1.14 and prior MELSEC-F Series FX3U-ENET-L firmware versions 1.14 and prior MELSEC-F Series FX3U-ENET-P502 firmware versions 1.14 and prior

Description: A NULL Pointer Dereference issue allows a remote unauthenticated attacker to cause a DoS condition in communication by sending specially crafted packets. Control by MELSEC-F series PLC is not affected, and system reset is required for recovery.

Recommendations: For MELSEC-F Series FX3U-ENET firmware versions 1.14 and prior, update to a version later than 1.14 to resolve the issue. For MELSEC-F Series FX3U-ENET-L firmware versions 1.14 and prior, update to a version later than 1.14 to resolve the issue. For MELSEC-F Series FX3U-ENET-P502 firmware versions 1.14 and prior, update to a version later than 1.14 to resolve the issue. As a temporary workaround, consider restricting access to the affected devices to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2021-20596

Affected Products

Melsec-F Series Fx3U-Enet

Melsec-F Series Fx3U-Enet-P502

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-20596 · Security Note
• https://jvn.jp/vu/JVNVU94348759/index.html · Patch
• https://osv.dev/vulnerability/CVE-2021-20596 · Vendor Advisory
• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-006_en.pdf · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-21-201-01 · Note
• https://t.me/cvenotify/18464 · Telegram Post
• https://t.me/cibsecurity/26370 · Telegram Post