critical9.1
CVE-2021-20599
Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCP…
Impact
Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mitsubishielectric | R08sfcpu Firmware | All versions |
| Mitsubishielectric | R16sfcpu Firmware | All versions |
| Mitsubishielectric | R32sfcpu Firmware | All versions |
| Mitsubishielectric | R120sfcpu Firmware | All versions |
| Mitsubishielectric | R08psfcpu Firmware | All versions |
| Mitsubishielectric | R16psfcpu Firmware | All versions |
| Mitsubishielectric | R32psfcpu Firmware | All versions |
| Mitsubishielectric | R120psfcpu Firmware | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://jvn.jp/vu/JVNVU98578731
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf
- https://jvn.jp/vu/JVNVU98578731
- https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf