Lucene search

[email protected]CVE-2021-20587

HistoryFeb 19, 2021 - 8:15 p.m.

CVE-2021-20587

2021-02-1920:15:12

CWE-787

[email protected]

web.nvd.nist.gov

cve-2021-20587

mitsubishi electric

fa engineering software

buffer overflow

vulnerability

remote attacker

dos

malicious program

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.6%

JSON

Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (CPU Module Logging Configuration Tool versions 1.112R and prior, CW Configurator versions 1.011M and prior, Data Transfer versions 3.44W and prior, EZSocket versions 5.4 and prior, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 versions 1.24A and prior, GT Designer3 Version1(GOT1000) versions 1.250L and prior, GT Designer3 Version1(GOT2000) versions 1.250L and prior, GT SoftGOT1000 Version3 versions 3.245F and prior, GT SoftGOT2000 Version1 versions 1.250L and prior, GX Configurator-DP versions 7.14Q and prior, GX Configurator-QP all versions, GX Developer versions 8.506C and prior, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer versions 1.115U and prior, GX RemoteService-I all versions, GX Works2 versions 1.597X and prior, GX Works3 versions 1.070Y and prior, iQ Monozukuri ANDON (Data Transfer) all versions, iQ Monozukuri Process Remote Monitoring (Data Transfer) all versions, M_CommDTM-HART all versions, M_CommDTM-IO-Link versions 1.03D and prior, MELFA-Works versions 4.4 and prior, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Development Kit (EM Configurator) versions 1.015R and prior, MELSOFT Navigator versions 2.74C and prior, MH11 SettingTool Version2 versions 2.004E and prior, MI Configurator versions 1.004E and prior, MT Works2 versions 1.167Z and prior, MX Component versions 5.001B and prior, Network Interface Board CC IE Control utility versions 1.29F and prior, Network Interface Board CC IE Field Utility versions 1.16S and prior, Network Interface Board CC-Link Ver.2 Utility versions 1.23Z and prior, Network Interface Board MNETH utility versions 34L and prior, PX Developer versions 1.53F and prior, RT ToolBox2 versions 3.73B and prior, RT ToolBox3 versions 1.82L and prior, Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) versions 4.12N and prior and SLMP Data Collector versions 1.04E and prior) allows a remote unauthenticated attacker to cause a DoS condition of the software products, and possibly to execute a malicious program on the personal computer running the software products although it has not been reproduced, by spoofing MELSEC, GOT or FREQROL and returning crafted reply packets.

Affected configurations

NVD

Node

mitsubishielectricc_controller_module_setting_and_monitoring_tool

mitsubishielectriccpu_module_logging_configuration_toolRange≤1.112r

mitsubishielectriccw_configuratorRange≤1.011m

mitsubishielectricdata_transferRange≤3.44w

mitsubishielectricezsocket

mitsubishielectricfr_configurator

mitsubishielectricfr_configurator_sw3

mitsubishielectricfr_configurator2Range≤1.24a

mitsubishielectricgt_designer3Range≤1.250l

mitsubishielectricgt_softgot1000Range≤3.245f

mitsubishielectricgt_softgot2000Range≤1.250l

mitsubishielectricgx_configurator-dpRange≤7.14q

mitsubishielectricgx_configurator-qp

mitsubishielectricgx_developerRange≤8.506c

mitsubishielectricgx_explorer

mitsubishielectricgx_iec_developer

mitsubishielectricgx_logviewerRange≤1.115u

mitsubishielectricgx_remoteservice-i

mitsubishielectricgx_works2Range≤1.597x

mitsubishielectricgx_works3Range≤1.070y

mitsubishielectriciq_monozukuri_andonMatch-

mitsubishielectriciq_monozukuri_process_remote_monitoringMatch-

mitsubishielectricm_commdtm-hart

mitsubishielectricm_commdtm-io-link

mitsubishielectricmelfa-worksRange≤4.4

mitsubishielectricmelsec_wincpu_setting_utility

mitsubishielectricmelsoft_em_software_development_kit

mitsubishielectricmelsoft_navigatorRange≤2.74c

mitsubishielectricmh11_settingtool_version2Range≤2.004e

mitsubishielectricmi_configurator

mitsubishielectricmt_works2Range≤1.167z

mitsubishielectricmx_componentRange≤5.001b

mitsubishielectricnetwork_interface_board_cc-link

mitsubishielectricnetwork_interface_board_cc_ie_control_utility

mitsubishielectricnetwork_interface_board_cc_ie_field_utility

mitsubishielectricnetwork_interface_board_mneth_utility

mitsubishielectricpx_developerRange≤1.53f

mitsubishielectricrt_toolbox2Range≤3.73b

mitsubishielectricrt_toolbox3Range≤1.82l

mitsubishielectricsetting\/monitoring_tools_for_the_c_controller_module

mitsubishielectricslmp_data_collectorRange≤1.04e

CPENameOperatorVersion
mitsubishielectric:c_controller_module_setting_and_monitoring_toolmitsubishielectric c controller module setting and monitoring tooleq*
mitsubishielectric:cpu_module_logging_configuration_toolmitsubishielectric cpu module logging configuration toolle1.112r
mitsubishielectric:cw_configuratormitsubishielectric cw configuratorle1.011m
mitsubishielectric:data_transfermitsubishielectric data transferle3.44w
mitsubishielectric:ezsocketmitsubishielectric ezsocketeq*
mitsubishielectric:fr_configuratormitsubishielectric fr configuratoreq*
mitsubishielectric:fr_configurator_sw3mitsubishielectric fr configurator sw3eq*
mitsubishielectric:fr_configurator2mitsubishielectric fr configurator2le1.24a
mitsubishielectric:gt_designer3mitsubishielectric gt designer3le1.250l
mitsubishielectric:gt_softgot1000mitsubishielectric gt softgot1000le3.245f

CPE	Name	Operator	Version
mitsubishielectric:c_controller_module_setting_and_monitoring_tool	mitsubishielectric c controller module setting and monitoring tool	eq	*
mitsubishielectric:cpu_module_logging_configuration_tool	mitsubishielectric cpu module logging configuration tool	le	1.112r
mitsubishielectric:cw_configurator	mitsubishielectric cw configurator	le	1.011m
mitsubishielectric:data_transfer	mitsubishielectric data transfer	le	3.44w
mitsubishielectric:ezsocket	mitsubishielectric ezsocket	eq	*
mitsubishielectric:fr_configurator	mitsubishielectric fr configurator	eq	*
mitsubishielectric:fr_configurator_sw3	mitsubishielectric fr configurator sw3	eq	*
mitsubishielectric:fr_configurator2	mitsubishielectric fr configurator2	le	1.24a
mitsubishielectric:gt_designer3	mitsubishielectric gt designer3	le	1.250l
mitsubishielectric:gt_softgot1000	mitsubishielectric gt softgot1000	le	3.245f

Rows per page:

1-10 of 411

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "FA Engineering Software",
    "vendor": "Mitsubishi Electric Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "CPU Module Logging Configuration Tool versions 1.112R and prior"
      },
      {
        "status": "affected",
        "version": "CW Configurator versions 1.011M and prior"
      },
      {
        "status": "affected",
        "version": "Data Transfer versions 3.44W and prior"
      },
      {
        "status": "affected",
        "version": "EZSocket versions 5.4 and prior"
      },
      {
        "status": "affected",
        "version": "FR Configurator all versions"
      },
      {
        "status": "affected",
        "version": "FR Configurator SW3 all versions"
      },
      {
        "status": "affected",
        "version": "FR Configurator2 versions 1.24A and prior"
      },
      {
        "status": "affected",
        "version": "GT Designer3 Version1(GOT1000) versions 1.250L and prior"
      },
      {
        "status": "affected",
        "version": "GT Designer3 Version1(GOT2000) versions 1.250L and prior"
      },
      {
        "status": "affected",
        "version": "GT SoftGOT1000 Version3 versions 3.245F and prior"
      },
      {
        "status": "affected",
        "version": "GT SoftGOT2000 Version1 versions 1.250L and prior"
      },
      {
        "status": "affected",
        "version": "GX Configurator-DP versions 7.14Q and prior"
      },
      {
        "status": "affected",
        "version": "GX Configurator-QP all versions"
      },
      {
        "status": "affected",
        "version": "GX Developer versions 8.506C and prior"
      },
      {
        "status": "affected",
        "version": "GX Explorer all versions"
      },
      {
        "status": "affected",
        "version": "GX IEC Developer all versions"
      },
      {
        "status": "affected",
        "version": "GX LogViewer versions 1.115U and prior"
      },
      {
        "status": "affected",
        "version": "GX RemoteService-I all versions"
      },
      {
        "status": "affected",
        "version": "GX Works2 versions 1.597X and prior"
      },
      {
        "status": "affected",
        "version": "GX Works3 versions 1.070Y and prior"
      },
      {
        "status": "affected",
        "version": "iQ Monozukuri ANDON (Data Transfer) all versions"
      },
      {
        "status": "affected",
        "version": "iQ Monozukuri Process Remote Monitoring (Data Transfer) all versions"
      },
      {
        "status": "affected",
        "version": "M_CommDTM-HART all versions"
      },
      {
        "status": "affected",
        "version": "M_CommDTM-IO-Link versions 1.03D and prior"
      },
      {
        "status": "affected",
        "version": "MELFA-Works versions 4.4 and prior"
      },
      {
        "status": "affected",
        "version": "MELSEC WinCPU Setting Utility all versions"
      },
      {
        "status": "affected",
        "version": "MELSOFT EM Software Development Kit (EM Configurator) versions 1.015R and prior"
      },
      {
        "status": "affected",
        "version": "MELSOFT Navigator versions 2.74C and prior"
      },
      {
        "status": "affected",
        "version": "MH11 SettingTool Version2 versions 2.004E and prior"
      },
      {
        "status": "affected",
        "version": "MI Configurator versions 1.004E and prior"
      },
      {
        "status": "affected",
        "version": "MT Works2 versions 1.167Z and prior"
      },
      {
        "status": "affected",
        "version": "MX Component versions 5.001B and prior"
      },
      {
        "status": "affected",
        "version": "Network Interface Board CC IE Control utility versions 1.29F and prior"
      },
      {
        "status": "affected",
        "version": "Network Interface Board CC IE Field Utility versions 1.16S and prior"
      },
      {
        "status": "affected",
        "version": "Network Interface Board CC-Link Ver.2 Utility versions 1.23Z and prior"
      },
      {
        "status": "affected",
        "version": "Network Interface Board MNETH utility versions 34L and prior"
      },
      {
        "status": "affected",
        "version": "PX Developer versions 1.53F and prior"
      },
      {
        "status": "affected",
        "version": "RT ToolBox2 versions 3.73B and prior"
      },
      {
        "status": "affected",
        "version": "RT ToolBox3 versions 1.82L and prior"
      },
      {
        "status": "affected",
        "version": "Setting/monitoring tools for the C Controller module (SW4PVC-CCPU) versions 4.12N and prior"
      },
      {
        "status": "affected",
        "version": "SLMP Data Collector versions 1.04E and prior"
      }
    ]
  }
]

References

jvn.jp/vu/JVNVU92330101/index.html

us-cert.cisa.gov/ics/advisories/icsa-21-049-02

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2020-021_en.pdf

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.6%

JSON

Related for CVE-2021-20587

nessus1 cvelist1 prion1 nvd1 ics1