Lucene search

[email protected]CVE-2021-20597

HistoryAug 06, 2021 - 5:15 p.m.

CVE-2021-20597

2021-08-0617:15:00

CWE-522

[email protected]

web.nvd.nist.gov

cve-2021-20597

vulnerability

mitsubishi electric

melsec

iq-r

safety cpu

sil2

process cpu

unauthorized login

network sniffing

credentials protection

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

71.9%

JSON

Insufficiently Protected Credentials vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions “26” and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU all versions allows a remote unauthenticated attacker to login to the target unauthorizedly by sniffing network traffic and obtaining credentials when registering user information in the target or changing a password.

CPENameOperatorVersion
mitsubishielectric:r08sfcpu_firmwaremitsubishielectric r08sfcpu firmwareeq*
mitsubishielectric:r16sfcpu_firmwaremitsubishielectric r16sfcpu firmwareeq*
mitsubishielectric:r32sfcpu_firmwaremitsubishielectric r32sfcpu firmwareeq*
mitsubishielectric:r120sfcpu_firmwaremitsubishielectric r120sfcpu firmwareeq*
mitsubishielectric:r08psfcpu_firmwaremitsubishielectric r08psfcpu firmwareeq*
mitsubishielectric:r16psfcpu_firmwaremitsubishielectric r16psfcpu firmwareeq*
mitsubishielectric:r32psfcpu_firmwaremitsubishielectric r32psfcpu firmwareeq*
mitsubishielectric:r120psfcpu_firmwaremitsubishielectric r120psfcpu firmwareeq*

CPE	Name	Operator	Version
mitsubishielectric:r08sfcpu_firmware	mitsubishielectric r08sfcpu firmware	eq	*
mitsubishielectric:r16sfcpu_firmware	mitsubishielectric r16sfcpu firmware	eq	*
mitsubishielectric:r32sfcpu_firmware	mitsubishielectric r32sfcpu firmware	eq	*
mitsubishielectric:r120sfcpu_firmware	mitsubishielectric r120sfcpu firmware	eq	*
mitsubishielectric:r08psfcpu_firmware	mitsubishielectric r08psfcpu firmware	eq	*
mitsubishielectric:r16psfcpu_firmware	mitsubishielectric r16psfcpu firmware	eq	*
mitsubishielectric:r32psfcpu_firmware	mitsubishielectric r32psfcpu firmware	eq	*
mitsubishielectric:r120psfcpu_firmware	mitsubishielectric r120psfcpu firmware	eq	*

References

jvn.jp/vu/JVNVU98578731/index.html

www.cisa.gov/uscert/ics/advisories/icsa-21-250-01

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-009_en.pdf

Social References

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

71.9%

JSON

Related for CVE-2021-20597

prion1 nessus3 thn1 ics1