Vulnerability · Published Dec 17, 2021 · Assigned by Mitsubishi

CVE-2021-20608

High 7.5

In plain English

A high-severity security flaw in GX Works2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.9%top 13.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric GX Works2 versions 1.606G and prior allows a remote unauthenticated attacker to cause a DoS condition in GX Works2 by getting GX Works2 to read a tampered program file from a Mitsubishi Electric PLC by sending malicious crafted packets to tamper with the program file.

Affected products (as reported)

Vendor	Product	Versions
n/a	GX Works2	versions 1.606G and prior

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-020_en.pdf x_refsource_MISC
https://jvn.jp/vu/JVNVU93019896/index.html x_refsource_MISC
https://us-cert.cisa.gov/ics/advisories/icsa-21-350-04 x_refsource_MISC