CVE-2021-20599 - Vulnerability Details - OpenCVE

Description

Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.

Published: 2021-10-14

Score: 9.1 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Mitsubishi Electric Corporation

MELSEC iQ-R Series Safety CPU R08SFCPU

unaffected

Version	Status	Constraints
`Firmware versions "26" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series Safety CPU R16SFCPU

unaffected

Version	Status	Constraints
`Firmware versions "26" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series Safety CPU R32SFCPU

unaffected

Version	Status	Constraints
`Firmware versions "26" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series Safety CPU R120SFCPU

unaffected

Version	Status	Constraints
`Firmware versions "26" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU

unaffected

Version	Status	Constraints
`Firmware versions "11" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series SIL2 Process CPU R16PSFCPU

unaffected

Version	Status	Constraints
`Firmware versions "11" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series SIL2 Process CPU R32PSFCPU

unaffected

Version	Status	Constraints
`Firmware versions "11" and prior`	affected	—

Mitsubishi Electric Corporation

MELSEC iQ-R series SIL2 Process CPU R120PSFCPU

unaffected

Version	Status	Constraints
`Firmware versions "11" and prior`	affected	—

Configuration 1 [-]

AND

cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2021-8017	Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions "26" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions "11" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00332.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://jvn.jp/vu/JVNVU98578731
https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03
https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf

History

Wed, 25 Feb 2026 15:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mitsubishielectric melsec Iq-r08sfcpu
CPEs		cpe:2.3:h:mitsubishielectric:melsec_iq-r08sfcpu:-:::::::*
Vendors & Products		Mitsubishielectric melsec Iq-r08sfcpu
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Mitsubishielectric Melsec Iq-r08sfcpu R08psfcpu R08psfcpu Firmware R08sfcpu R08sfcpu Firmware R120psfcpu R120psfcpu Firmware R120sfcpu R120sfcpu Firmware R16psfcpu R16psfcpu Firmware R16sfcpu R16sfcpu Firmware R32psfcpu R32psfcpu Firmware R32sfcpu R32sfcpu Firmware

MITRE

Status: PUBLISHED

Assigner: Mitsubishi

Published: 2021-10-14T00:00:00.000Z

Updated: 2024-08-03T17:45:44.681Z

Reserved: 2020-12-17T00:00:00.000Z

Link: CVE-2021-20599

Vulnrichment

Updated: 2024-08-03T17:45:44.681Z

NVD

Status : Modified

Published: 2021-10-14T15:15:08.827

Modified: 2024-11-21T05:46:51.317

Link: CVE-2021-20599

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2021-20599", "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "assignerShortName": "Mitsubishi", "dateUpdated": "2024-08-03T17:45:44.681Z", "dateReserved": "2020-12-17T00:00:00.000Z", "datePublished": "2021-10-14T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series Safety CPU R08SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series Safety CPU R16SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series Safety CPU R32SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series Safety CPU R120SFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series SIL2 Process CPU R16PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series SIL2 Process CPU R32PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}]}, {"defaultStatus": "unaffected", "product": "MELSEC iQ-R series SIL2 Process CPU R120PSFCPU", "vendor": "Mitsubishi Electric Corporation", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password."}], "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password."}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "shortName": "Mitsubishi", "dateUpdated": "2024-04-18T05:28:04.068Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf"}, {"tags": ["government-resource"], "url": "https://jvn.jp/vu/JVNVU98578731"}, {"tags": ["government-resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-20599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-22T20:51:10.357119Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:mitsubishielectric:melsec_iq-r08sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "melsec_iq-r08sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r16sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r32sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r120sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r08psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r16psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r32psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r120psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:12:41.515Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:45:44.681Z"}, "title": "CVE Program Container", "references": [{"tags": ["vendor-advisory", "x_transferred"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf"}, {"tags": ["government-resource", "x_transferred"], "url": "https://jvn.jp/vu/JVNVU98578731"}, {"tags": ["government-resource", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://jvn.jp/vu/JVNVU98578731", "tags": ["government-resource", "x_transferred"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03", "tags": ["government-resource", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:45:44.681Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-20599", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-22T20:51:10.357119Z"}}}], "affected": [{"cpes": ["cpe:2.3:h:mitsubishielectric:melsec_iq-r08sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "melsec_iq-r08sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r16sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r32sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r120sfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r08psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r16psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r32psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*"], "vendor": "mitsubishielectric", "product": "r120psfcpu", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-22T20:56:35.290Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R Series Safety CPU R08SFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series Safety CPU R16SFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series Safety CPU R32SFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series Safety CPU R120SFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"26\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series SIL2 Process CPU R16PSFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series SIL2 Process CPU R32PSFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}], "defaultStatus": "unaffected"}, {"vendor": "Mitsubishi Electric Corporation", "product": "MELSEC iQ-R series SIL2 Process CPU R120PSFCPU", "versions": [{"status": "affected", "version": "Firmware versions \"11\" and prior"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf", "tags": ["vendor-advisory"]}, {"url": "https://jvn.jp/vu/JVNVU98578731", "tags": ["government-resource"]}, {"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.", "supportingMedia": [{"type": "text/html", "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "shortName": "Mitsubishi", "dateUpdated": "2024-04-18T05:28:04.068Z"}}}, "cveMetadata": {"cveId": "CVE-2021-20599", "state": "PUBLISHED", "dateUpdated": "2024-08-03T17:45:44.681Z", "dateReserved": "2020-12-17T00:00:00.000Z", "assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad", "datePublished": "2021-10-14T00:00:00.000Z", "assignerShortName": "Mitsubishi"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r08sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "66D3AC7B-50E0-47D5-B0D1-07329D724EFE", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r08sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "B185323A-C9E3-48A0-AD28-DA7AC7846E18", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r16sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA81D5C7-46C8-4F0E-9550-D240DC0366F3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "C4BBE066-33C4-4410-85D3-4B77B3773330", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r32sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FB53D61-6C69-4A4A-92B1-C10D0B8F0EC9", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "6F6304BE-DAEE-49AB-B0B1-CEE6878CBECE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r120sfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8218130C-4E7D-4FB9-976B-2351977C82D4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "515BDC46-5A1C-4A94-816A-B4751BB1B58D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r08psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5A63D33D-302A-428C-986F-FC3F83CE9C86", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "EA37F2FC-8F75-4FEA-882D-87AD5CC1558E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r16psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "FFB42739-E503-44B2-A020-0DB2B8791A81", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "17AD5875-B7D7-498B-9484-23049753133E", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r32psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B1F532B-8EAF-4E66-9AF5-5EEFF5A0BC23", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "0EC2594C-6067-40BA-B8B2-AEC9B9C7922F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitsubishielectric:r120psfcpu_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2C03EA2-34BF-4F86-A19C-2818788E092B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*", "matchCriteriaId": "CA3FB3E1-D7D3-424B-A207-D3C6F4365D12", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password."}, {"lang": "es", "value": "La vulnerabilidad de transmisi\u00f3n de texto claro de informaci\u00f3n sensible en las versiones de firmware \"26\" y anteriores de la CPU de seguridad R08/16/32/120SFCPU de la serie iQ-R de MELSEC y en la CPU de proceso SIL2 R08/16/32/120PSFCPU de la serie iQ-R de MELSEC, en todas sus versiones, permite que un atacante remoto no autenticado inicie sesi\u00f3n en un m\u00f3dulo de CPU objetivo obteniendo credenciales distintas de la contrase\u00f1a"}], "id": "CVE-2021-20599", "lastModified": "2024-11-21T05:46:51.317", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-14T15:15:08.827", "references": [{"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/vu/JVNVU98578731"}, {"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"}, {"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "tags": ["Vendor Advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/vu/JVNVU98578731"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf"}], "sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-639"}], "source": "nvd@nist.gov", "type": "Secondary"}]}