CVE-2021-20594

Published: Aug 6, 2021Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mitsubishi Electric MELSEC iQ-R series Safety CPU modules R08/16/32/120SFCPU firmware versions "26" and prior and Mitsubishi Electric MELSEC iQ-R series SIL2 Process CPU modules R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to acquire legitimate user names registered in the module via brute-force attack on user names.

Affected (8)

Products: Mitsubishielectric: R08sfcpu Firmware, R16sfcpu Firmware, R32sfcpu Firmware, R120sfcpu Firmware, R08psfcpu Firmware, R16psfcpu Firmware, R32psfcpu Firmware, R120psfcpu Firmware

8 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric R08sfcpu Firmware	All versions

Running on/with	Platform Versions
Mitsubishielectric R08sfcpu	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric R16sfcpu Firmware	All versions

Running on/with	Platform Versions
Mitsubishielectric R16sfcpu	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric R32sfcpu Firmware	All versions

Running on/with	Platform Versions
Mitsubishielectric R32sfcpu	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric R120sfcpu Firmware	All versions

Running on/with	Platform Versions
Mitsubishielectric R120sfcpu	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric R08psfcpu Firmware	All versions

Running on/with	Platform Versions
Mitsubishielectric R08psfcpu	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric R16psfcpu Firmware	All versions

Running on/with	Platform Versions
Mitsubishielectric R16psfcpu	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric R32psfcpu Firmware	All versions

Running on/with	Platform Versions
Mitsubishielectric R32psfcpu	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Mitsubishielectric R120psfcpu Firmware	All versions

Running on/with	Platform Versions
Mitsubishielectric R120psfcpu	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

https://jvn.jp/vu/JVNVU98578731/index.html

Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

Third Party Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01

Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-008_en.pdf

Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp

Vendor Advisory

https://jvn.jp/vu/JVNVU98578731/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.cisa.gov/uscert/ics/advisories/icsa-21-250-01

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-008_en.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.