CVE-2021-20600

low-risk
Published 2021-10-08

Uncontrolled resource consumption in Mitsubishi Electric MELSEC iQ-R series C Controller Module R12CCPU-V Firmware Versions "16" and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending a large number of packets in a short time while the module starting up. System reset is required for recovery.

Do I need to act?

-
0.52% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

R12Ccpu-V Firmware

Affected Vendors

Mitsubishielectric

References (6)

Third Party Advisory https://jvn.jp/vu/JVNVU94914666/index.html
Third Party Advisory https://us-cert.cisa.gov/ics/advisories/icsa-21-280-04
Vendor Advisory https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-015_en.pdf
Third Party Advisory https://jvn.jp/vu/JVNVU94914666/index.html
Third Party Advisory https://us-cert.cisa.gov/ics/advisories/icsa-21-280-04
Vendor Advisory https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-015_en.pdf
25
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 2/34 · Minimal
Exposure 5/34 · Minimal