PT-2021-8029 · Mitsubishi · Melsec Iq-R Series Sil2 Process Cpu+1

Ivan Speziale · Published 2021-10-14 · Updated 2024-05-14 · CVE-2021-20599

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU versions prior to 26 MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU versions prior to 11

Description The issue is related to the transmission of credentials in an unencrypted form, allowing a remote attacker to gain unauthorized access to protected information. This can enable an attacker to log in to a target CPU module by obtaining credentials other than a password.

Recommendations For MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU versions prior to 26, update the firmware to version 27 or later. For MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU versions prior to 11, update the firmware to version 12 or later. As a temporary workaround, consider restricting access to the CPU modules to minimize the risk of exploitation.

Fix

IDOR

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-639

CWE-319

Related Identifiers

BDU:2024-03610

CVE-2021-20599

Affected Products

Melsec Iq-R Series Sil2 Process Cpu

Melsec Iq-R Series Safety Cpu

References · 8

• https://mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20599 · Security Note
• https://bdu.fstec.ru/vul/2024-03610 · Security Note
• https://t.me/cvenotify/77266 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-21-287-03 · Note
• https://t.me/cibsecurity/30564 · Telegram Post
• https://cisa.gov/uscert/ics/advisories/icsa-21-287-03 · Note
• https://jvn.jp/vu/JVNVU98578731 · Note