CVE-2021-20599

Katalog CVE

CVSS 7.5 · High EPSS 1,4%

Kerentanan Cleartext Transmission of Sensitive Information pada mitsubishielectric r08sfcpu firmware, mitsubishielectric r16sfcpu firmware +6 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.

Rincian

Terbit di NVD

14 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-319: Cleartext Transmission of Sensitive Information
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf advisory vendor
• https://jvn.jp/vu/JVNVU98578731 advisory pihak ketiga
• https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03