CVE-2021-20606
mediumpriority · track · 22EPSS 0.010 · 62 %ileEUUSEPSS · scored 2026-10-27
Out-of-bounds Read vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior, Mitsubishi Electric MELSOFT Navigator versions 2.84N and prior and Mitsubishi Electric EZSocket versions 5.4 and prior allows an attacker to cause a DoS condition in the software by getting a user to open malicious project file specially crafted by an attacker.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedEZSocketcisa_csaf_ot
Please execute procedures below for GX Works2 project files read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. With GX Works2 1.610L or later, open the project file that is read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. Enable the option [Enable the security check for the project] ([Options] -> [Project] -> [Common Setting]) and save the project.
- FixedGX Works2cisa_csaf_ot
Please execute procedures below for GX Works2 project files read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. With GX Works2 1.610L or later, open the project file that is read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. Enable the option [Enable the security check for the project] ([Options] -> [Project] -> [Common Setting]) and save the project.
- FixedMELSOFT Navigatorcisa_csaf_ot
Please execute procedures below for GX Works2 project files read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. With GX Works2 1.610L or later, open the project file that is read from PLC via “Batch Read” function of MELSOFT Navigator or EZSocket. Enable the option [Enable the security check for the project] ([Options] -> [Project] -> [Common Setting]) and save the project.
- MitigationEZSocketcisa_csaf_ot
Do not open the project files, such as those attached to e-mail sent from an untrusted sender.
- MitigationGX Works2cisa_csaf_ot
Do not open the project files, such as those attached to e-mail sent from an untrusted sender.
- MitigationMELSOFT Navigatorcisa_csaf_ot
Do not open the project files, such as those attached to e-mail sent from an untrusted sender.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (12)
Products and version ranges known to be affected.
- n/a Mitsubishi Electric GX Works2; Mitsubishi Electric MELSOFT Navigator; Mitsubishi Electric EZSocket≤ Mitsubishi Electric MELSOFT Navigator versions 2.84N and priorenisa_euvdEU
- n/a Mitsubishi Electric GX Works2; Mitsubishi Electric MELSOFT Navigator; Mitsubishi Electric EZSocket≤ Mitsubishi Electric EZSocket versions 5.4 and priorenisa_euvdEU
- n/a Mitsubishi Electric GX Works2; Mitsubishi Electric MELSOFT Navigator; Mitsubishi Electric EZSocket≤ Mitsubishi Electric GX Works2 versions 1.606G and priorenisa_euvdEU
- mitsubishielectric melsoft navigatorall versionsnvdUScpe:2.3:a:mitsubishielectric:melsoft_navigator:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-21-350-05Mitsubishi Electric FA Engineering Software (Update B)2021-12-16icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may cause a denial-of-service condition.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://jvn.jp/vu/JVNVU93817405/index.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-20606cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.4288cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2022010506cnnvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-021_en.pdfcnnvd
- https://jvn.jp/vu/JVNVU93817405/index.htmlenisa_euvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-350-05enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan