CVE-2021-20586

high-risk
Published 2021-01-29

Resource management errors vulnerability in a robot controller of MELFA FR Series(controller "CR800-*V*D" of RV-*FR***-D-* all versions, controller "CR800-*HD" of RH-*FRH***-D-* all versions, controller "CR800-*HRD" of RH-*FRHR***-D-* all versions, controller "CR800-*V*R with R16RTCPU" of RV-*FR***-R-* all versions, controller "CR800-*HR with R16RTCPU" of RH-*FRH***-R-* all versions, controller "CR800-*HRR with R16RTCPU" of RH-*FRHR***-R-* all versions, controller "CR800-*V*Q with Q172DSRCPU" of RV-*FR***-Q-* all versions, controller "CR800-*HQ with Q172DSRCPU" of RH-*FRH***-Q-* all versions, controller "CR800-*HRQ with Q172DSRCPU" of RH-*FRHR***-Q-* all versions) and a robot controller of MELFA CR Series(controller "CR800-CVD" of RV-8CRL-D-* all versions, controller "CR800-CHD" of RH-*CRH**-D-* all versions) as well as a cooperative robot ASSISTA(controller "CR800-05VD" of RV-5AS-D-* all versions) allows a remote unauthenticated attacker to cause a DoS of the execution of the robot program and the Ethernet communication by sending a large amount of packets in burst over a short period of time. As a result of DoS, an error may occur. A reset is required to recover it if the error occurs.

Do I need to act?

~
2.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Rv2Fr Firmware
Rv2Frl Firmware
Rv4Fr Firmware
Rv4Frl Firmware
Rv7Fr Firmware
Rv7Frl Firmware
Rv7Frll Firmware
Rv13Fr Firmware
Rv13Frl Firmware
Rv20Fr Firmware
Rh1Frhr Firmware
Rh3Frhr Firmware
Rh3Frh35 Firmware
Rh3Frh45 Firmware
Rh3Frh55 Firmware
Rh6Frh35 Firmware
Rh6Frh45 Firmware
Rh6Frh55 Firmware
Rh12Frh55 Firmware
Rh12Rfh70 Firmware

Affected Vendors

54
/ 100
high-risk
Severity 26/34 · High
Exploitability 5/34 · Minimal
Exposure 23/34 · High