CVE-2021-20612

· HIGHModified

← All CVEs

CVSS v3.1

7.5

EPSS

3.60%

Published

Jan 14, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L Firmware version 1.14 and prior and FX3U-ENET-P502 Firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in communication function of the product or other unspecified effects by sending specially crafted packets to an unnecessary opening of TCP port. Control by MELSEC-F series PLC is not affected by this vulnerability, but system reset is required for recovery.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products (6)

mitsubishielectric · fx3u-enet_firmwarevulnerable

mitsubishielectric · fx3u-enet

mitsubishielectric · fx3u-enet-l_firmwarevulnerable

mitsubishielectric · fx3u-enet-l

mitsubishielectric · fx3u-enet-p502_firmwarevulnerable

mitsubishielectric · fx3u-enet-p502

References (6)

https://jvn.jp/vu/JVNVU93268332/index.html

Third Party AdvisoryVDB Entry