CVE-2021-20612
highpriority · track · 31EPSS 0.036 · 89 %ileEUUSEPSS · scored 2026-10-26
Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L Firmware version 1.14 and prior and FX3U-ENET-P502 Firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in communication function of the product or other unspecified effects by sending specially crafted packets to an unnecessary opening of TCP port. Control by MELSEC-F series PLC is not affected by this vulnerability, but system reset is required for recovery.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationFX3U-ENET Firmwarecisa_csaf_ot
FX3U-ENET-L: Firmware Version 1.16 or later
- MitigationFX3U-ENET-L Firmwarecisa_csaf_ot
FX3U-ENET-L: Firmware Version 1.16 or later
- MitigationFX3U-ENET-P502 Firmwarecisa_csaf_ot
FX3U-ENET-L: Firmware Version 1.16 or later
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
- n/a MELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MELSEC-F series FX3U-ENET-P502≤ Firmware version 1.14 and priorenisa_euvdEU
- mitsubishielectric fx3u-enet firmware≤ 1.14nvdUScpe:2.3:o:mitsubishielectric:fx3u-enet_firmware:*:*:*:*:*:*:*:*
- mitsubishielectric fx3u-enet-l firmware≤ 1.14nvdUScpe:2.3:o:mitsubishielectric:fx3u-enet-l_firmware:*:*:*:*:*:*:*:*
- mitsubishielectric fx3u-enet-p502 firmware≤ 1.14nvdUScpe:2.3:o:mitsubishielectric:fx3u-enet-p502_firmware:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-22-013-01Mitsubishi Electric MELSEC-F Series2022-01-13icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could lead to a denial-of-service condition in the communication function of the product or cause other unspecified effects.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://jvn.jp/vu/JVNVU93268332/index.htmlcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-20612cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-22-013-01cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-013-01cnnvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-023_en.pdfcnnvd
- https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-024_en.pdfPatchcnnvd
- https://jvn.jp/vu/JVNVU93268332/index.htmlenisa_euvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-013-01enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan