CVE-2021-20606
mediumPriorität · verfolgen · 22EPSS 0.010 · 62. PerzentilEUUSEPSS · bewertet 2026-10-27
Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket versions 5.4 and prior allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenEZSocketcisa_csaf_ot
Please execute procedures below for GX Works2 project files read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. With GX Works2 1.610L or later, open the project file that is read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. Enable the option [Enable the security check for the project] ([Options] -> [Project] -> [Common Setting]) and save the project.
- BehobenGX Works2cisa_csaf_ot
Please execute procedures below for GX Works2 project files read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. With GX Works2 1.610L or later, open the project file that is read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. Enable the option [Enable the security check for the project] ([Options] -> [Project] -> [Common Setting]) and save the project.
- BehobenMELSOFT Navigatorcisa_csaf_ot
Please execute procedures below for GX Works2 project files read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. With GX Works2 1.610L or later, open the project file that is read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. Enable the option [Enable the security check for the project] ([Options] -> [Project] -> [Common Setting]) and save the project.
- MitigationEZSocketcisa_csaf_ot
Do not open the project files, such as those attached to e-mail sent from an untrusted sender.
- MitigationGX Works2cisa_csaf_ot
Do not open the project files, such as those attached to e-mail sent from an untrusted sender.
- MitigationMELSOFT Navigatorcisa_csaf_ot
Do not open the project files, such as those attached to e-mail sent from an untrusted sender.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (12)
Betroffene Produkte und Versionsbereiche.
- n/a Mitsubishi Electric GX Works2; Mitsubishi Electric MELSOFT Navigator; Mitsubishi Electric EZSocket≤ Mitsubishi Electric MELSOFT Navigator versions 2.84N and priorenisa_euvdEU
- n/a Mitsubishi Electric GX Works2; Mitsubishi Electric MELSOFT Navigator; Mitsubishi Electric EZSocket≤ Mitsubishi Electric EZSocket versions 5.4 and priorenisa_euvdEU
- n/a Mitsubishi Electric GX Works2; Mitsubishi Electric MELSOFT Navigator; Mitsubishi Electric EZSocket≤ Mitsubishi Electric GX Works2 versions 1.606G and priorenisa_euvdEU
- mitsubishielectric melsoft navigatoralle VersionennvdUScpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-21-350-05Mitsubishi Electric FA Engineering Software (Update B)2021-12-16icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may cause a denial-of-service condition.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://jvn.jp/vu/JVNVU93817405/index.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-20606cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4288cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022010506cnnvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-021_en.pdfcnnvd
- https://jvn.jp/vu/JVNVU93817405/index.htmlenisa_euvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan