← Back

CVE-2021-20599

nvd nist
Published: Oct 14, 2021Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.

Affected (8)

Mitsubishielectric
8 products
R08sfcpu Firmware
R16sfcpu Firmware
R32sfcpu Firmware
R120sfcpu Firmware
R08psfcpu Firmware
R16psfcpu Firmware
R32psfcpu Firmware
R120psfcpu Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
R08sfcpu Firmware
All versions
Running on/withPlatform Versions
Mitsubishielectric
R08sfcpu
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
R16sfcpu Firmware
All versions
Running on/withPlatform Versions
Mitsubishielectric
R16sfcpu
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
R32sfcpu Firmware
All versions
Running on/withPlatform Versions
Mitsubishielectric
R32sfcpu
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
R120sfcpu Firmware
All versions
Running on/withPlatform Versions
Mitsubishielectric
R120sfcpu
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
R08psfcpu Firmware
All versions
Running on/withPlatform Versions
Mitsubishielectric
R08psfcpu
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
R16psfcpu Firmware
All versions
Running on/withPlatform Versions
Mitsubishielectric
R16psfcpu
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
R32psfcpu Firmware
All versions
Running on/withPlatform Versions
Mitsubishielectric
R32psfcpu
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
R120psfcpu Firmware
All versions
Running on/withPlatform Versions
Mitsubishielectric
R120psfcpu
All versions

Related CWEs

CWE-319
Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (6)

Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Third Party Advisory
Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Source: Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.