CVE-2021-20596
mediumpriority · track · 31EPSS 0.022 · 82 %ileEUUSEPSS · scored 2026-10-27
NULL Pointer Dereference in MELSEC-F Series FX3U-ENET firmware version 1.14 and prior, FX3U-ENET-L firmware version 1.14 and prior and FX3U-ENET-P502 firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a DoS condition in communication by sending specially crafted packets. Control by MELSEC-F series PLC is not affected and system reset is required for recovery.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedFX3U-ENETcisa_csaf_ot
FX3U-ENET-L: Firmware Version 1.16 or later
- FixedFX3U-ENET-Lcisa_csaf_ot
FX3U-ENET-L: Firmware Version 1.16 or later
- FixedFX3U-ENET-P502cisa_csaf_ot
FX3U-ENET-L: Firmware Version 1.16 or later
- MitigationFX3U-ENETcisa_csaf_ot
Use a firewall or virtual private network (VPN), etc., to prevent unauthorized access when Internet access is required.
- MitigationFX3U-ENET-Lcisa_csaf_ot
Use a firewall or virtual private network (VPN), etc., to prevent unauthorized access when Internet access is required.
- MitigationFX3U-ENET-P502cisa_csaf_ot
Use a firewall or virtual private network (VPN), etc., to prevent unauthorized access when Internet access is required.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
- n/a MELSEC-F Series FX3U-ENET; FX3U-ENET-L; FX3U-ENET-P502≤ Firmware version 1.14 and priorenisa_euvdEU
- mitsubishielectric fx3u-enet firmware≤ 1.14nvdUScpe:2.3:o:mitsubishielectric:fx3u-enet_firmware:*:*:*:*:*:*:*:*
- mitsubishielectric fx3u-enet-l firmware≤ 1.14nvdUScpe:2.3:o:mitsubishielectric:fx3u-enet-l_firmware:*:*:*:*:*:*:*:*
- mitsubishielectric fx3u-enet-p502 firmware≤ 1.14nvdUScpe:2.3:o:mitsubishielectric:fx3u-enet-p502_firmware:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-21-201-01Mitsubishi Electric MELSEC-F Series2021-07-20icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability may cause a denial-of-service condition in communication with the product. System reset may be required for recovery.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://jvn.jp/vu/JVNVU94348759/index.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-20596cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-201-01cnnvd
- https://vigilance.fr/vulnerability/Elasticsearch-information-disclosure-via-Error-Reporting-35940Patchcnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2464cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021072103cnnvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-006_en.pdfcnnvd
- https://jvn.jp/vu/JVNVU94348759/index.htmlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan