Lucene search

[email protected]CVE-2021-20594

HistoryAug 06, 2021 - 5:15 p.m.

CVE-2021-20594

2021-08-0617:15:00

CWE-200

[email protected]

web.nvd.nist.gov

102

cve-2021-20594

vulnerability

mitsubishi electric

melsec

iq-r series

safety cpu

sil2 process cpu

firmware

remote attack

unauthorized access

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.3 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

68.5%

JSON

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions “26” and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to acquire legitimate user names registered in the module via brute-force attack on user names.

CPENameOperatorVersion
mitsubishielectric:r08sfcpu_firmwaremitsubishielectric r08sfcpu firmwareeq*
mitsubishielectric:r16sfcpu_firmwaremitsubishielectric r16sfcpu firmwareeq*
mitsubishielectric:r32sfcpu_firmwaremitsubishielectric r32sfcpu firmwareeq*
mitsubishielectric:r120sfcpu_firmwaremitsubishielectric r120sfcpu firmwareeq*
mitsubishielectric:r08psfcpu_firmwaremitsubishielectric r08psfcpu firmwareeq*
mitsubishielectric:r16psfcpu_firmwaremitsubishielectric r16psfcpu firmwareeq*
mitsubishielectric:r32psfcpu_firmwaremitsubishielectric r32psfcpu firmwareeq*
mitsubishielectric:r120psfcpu_firmwaremitsubishielectric r120psfcpu firmwareeq*

CPE	Name	Operator	Version
mitsubishielectric:r08sfcpu_firmware	mitsubishielectric r08sfcpu firmware	eq	*
mitsubishielectric:r16sfcpu_firmware	mitsubishielectric r16sfcpu firmware	eq	*
mitsubishielectric:r32sfcpu_firmware	mitsubishielectric r32sfcpu firmware	eq	*
mitsubishielectric:r120sfcpu_firmware	mitsubishielectric r120sfcpu firmware	eq	*
mitsubishielectric:r08psfcpu_firmware	mitsubishielectric r08psfcpu firmware	eq	*
mitsubishielectric:r16psfcpu_firmware	mitsubishielectric r16psfcpu firmware	eq	*
mitsubishielectric:r32psfcpu_firmware	mitsubishielectric r32psfcpu firmware	eq	*
mitsubishielectric:r120psfcpu_firmware	mitsubishielectric r120psfcpu firmware	eq	*

References

jvn.jp/vu/JVNVU98578731/index.html

www.cisa.gov/uscert/ics/advisories/icsa-21-250-01

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-008_en.pdf

Social References

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

8.3 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

68.5%

JSON

Related for CVE-2021-20594

prion1 nessus3 thn1 ics1