Lucene search

[email protected]CVE-2021-20598

HistoryAug 06, 2021 - 5:15 p.m.

CVE-2021-20598

2021-08-0617:15:00

CWE-287

[email protected]

web.nvd.nist.gov

cve-2021-20598

mitsubishi electric

melsec

iq-r

account lockout

vulnerability

remote attack

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.1 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.1%

JSON

Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric MELSEC iQ-R series CPU modules (R08/16/32/120SFCPU all versions, R08/16/32/120PSFCPU all versions) allows a remote unauthenticated attacker to lockout a legitimate user by continuously trying login with incorrect password.

CPENameOperatorVersion
mitsubishielectric:r08sfcpu_firmwaremitsubishielectric r08sfcpu firmwareeq*
mitsubishielectric:r16sfcpu_firmwaremitsubishielectric r16sfcpu firmwareeq*
mitsubishielectric:r32sfcpu_firmwaremitsubishielectric r32sfcpu firmwareeq*
mitsubishielectric:r120sfcpu_firmwaremitsubishielectric r120sfcpu firmwareeq*
mitsubishielectric:r08psfcpu_firmwaremitsubishielectric r08psfcpu firmwareeq*
mitsubishielectric:r16psfcpu_firmwaremitsubishielectric r16psfcpu firmwareeq*
mitsubishielectric:r32psfcpu_firmwaremitsubishielectric r32psfcpu firmwareeq*
mitsubishielectric:r120psfcpu_firmwaremitsubishielectric r120psfcpu firmwareeq*

CPE	Name	Operator	Version
mitsubishielectric:r08sfcpu_firmware	mitsubishielectric r08sfcpu firmware	eq	*
mitsubishielectric:r16sfcpu_firmware	mitsubishielectric r16sfcpu firmware	eq	*
mitsubishielectric:r32sfcpu_firmware	mitsubishielectric r32sfcpu firmware	eq	*
mitsubishielectric:r120sfcpu_firmware	mitsubishielectric r120sfcpu firmware	eq	*
mitsubishielectric:r08psfcpu_firmware	mitsubishielectric r08psfcpu firmware	eq	*
mitsubishielectric:r16psfcpu_firmware	mitsubishielectric r16psfcpu firmware	eq	*
mitsubishielectric:r32psfcpu_firmware	mitsubishielectric r32psfcpu firmware	eq	*
mitsubishielectric:r120psfcpu_firmware	mitsubishielectric r120psfcpu firmware	eq	*

References

jvn.jp/vu/JVNVU98578731/index.html

www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-010_en.pdf

Social References

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.1 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.002 Low

EPSS

Percentile

55.1%

JSON

Related for CVE-2021-20598

prion1 nessus1 ics1 thn1