{"id":"CVE-2021-20599","state":"PUBLISHED","title":"Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"","description":"Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password.","publishedAt":"2021-10-14T00:00:00.000Z","updatedAt":"2024-08-03T17:45:44.681Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"Mitsubishi"},"assigner":"Mitsubishi","products":["Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08SFCPU","Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R16SFCPU","Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R32SFCPU","Mitsubishi Electric Corporation MELSEC iQ-R series Safety CPU R120SFCPU","Mitsubishi Electric Corporation MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU","Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R16PSFCPU","Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R32PSFCPU","Mitsubishi Electric Corporation MELSEC iQ-R series SIL2 Process CPU R120PSFCPU"],"affected":[{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R Series Safety CPU R08SFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"26\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series Safety CPU R16SFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"26\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series Safety CPU R32SFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"26\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series Safety CPU R120SFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"26\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"11\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series SIL2 Process CPU R16PSFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"11\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series SIL2 Process CPU R32PSFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"11\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series SIL2 Process CPU R120PSFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"11\" and prior","status":"affected"}]}],"references":["https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf","https://jvn.jp/vu/JVNVU98578731","https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03"],"weaknesses":["CWE-319"],"ingestedAt":"2026-10-29T19:47:55.610Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/20xxx/CVE-2021-20599.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-20599","state":"PUBLISHED","datePublished":"2021-10-14T00:00:00.000Z","dateUpdated":"2024-08-03T17:45:44.681Z","assignerShortName":"Mitsubishi","assignerOrgId":"e0f77b61-78fd-4786-b3fb-1ee347a748ad","dateReserved":"2020-12-17T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Cleartext Transmission of Sensitive InformationCleartext transmission of sensitive information vulnerability in MELSEC iQ-R series Safety CPU R08/16/32/120SFCPU firmware versions \"26\" and prior and MELSEC iQ-R series SIL2 Process CPU R08/16/32/120PSFCPU firmware versions \"11\" and prior allows a remote unauthenticated attacker to login to a target CPU module by obtaining credentials other than password."}],"affected":[{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R Series Safety CPU R08SFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"26\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series Safety CPU R16SFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"26\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series Safety CPU R32SFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"26\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series Safety CPU R120SFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"26\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R Series SIL2 Process CPU R08PSFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"11\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series SIL2 Process CPU R16PSFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"11\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series SIL2 Process CPU R32PSFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"11\" and prior","status":"affected"}]},{"vendor":"Mitsubishi Electric Corporation","product":"MELSEC iQ-R series SIL2 Process CPU R120PSFCPU","defaultStatus":"unaffected","versions":[{"version":"Firmware versions \"11\" and prior","status":"affected"}]}],"references":[{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf","tags":["vendor-advisory"]},{"url":"https://jvn.jp/vu/JVNVU98578731","tags":["government-resource"]},{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03","tags":["government-resource"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-319","description":"CWE-319 Cleartext Transmission of Sensitive Information","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Mitsubishi","orgId":"e0f77b61-78fd-4786-b3fb-1ee347a748ad","dateUpdated":"2024-04-18T05:28:04.068Z"},"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"mitsubishielectric","product":"melsec_iq-r08sfcpu","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:h:mitsubishielectric:melsec_iq-r08sfcpu:-:*:*:*:*:*:*:*"]},{"vendor":"mitsubishielectric","product":"r16sfcpu","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:h:mitsubishielectric:r16sfcpu:-:*:*:*:*:*:*:*"]},{"vendor":"mitsubishielectric","product":"r32sfcpu","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:h:mitsubishielectric:r32sfcpu:-:*:*:*:*:*:*:*"]},{"vendor":"mitsubishielectric","product":"r120sfcpu","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:h:mitsubishielectric:r120sfcpu:-:*:*:*:*:*:*:*"]},{"vendor":"mitsubishielectric","product":"r08psfcpu","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:h:mitsubishielectric:r08psfcpu:-:*:*:*:*:*:*:*"]},{"vendor":"mitsubishielectric","product":"r16psfcpu","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:h:mitsubishielectric:r16psfcpu:-:*:*:*:*:*:*:*"]},{"vendor":"mitsubishielectric","product":"r32psfcpu","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:h:mitsubishielectric:r32psfcpu:-:*:*:*:*:*:*:*"]},{"vendor":"mitsubishielectric","product":"r120psfcpu","defaultStatus":"unknown","versions":[{"version":"-","status":"affected"}],"cpes":["cpe:2.3:h:mitsubishielectric:r120psfcpu:-:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2021-20599","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-04-22T20:51:10.357119Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T17:12:41.515Z"}},{"title":"CVE Program Container","references":[{"url":"https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-011_en.pdf","tags":["vendor-advisory","x_transferred"]},{"url":"https://jvn.jp/vu/JVNVU98578731","tags":["government-resource","x_transferred"]},{"url":"https://www.cisa.gov/uscert/ics/advisories/icsa-21-287-03","tags":["government-resource","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T17:45:44.681Z"}}]}}}