Vulnerability · Published Jan 14, 2022 · Assigned by Mitsubishi

CVE-2021-20612

High 7.5

In plain English

A high-severity security flaw in MELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MELSEC-F series FX3U-ENET-P502. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)3.6%top 10.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Lack of administrator control over security vulnerability in MELSEC-F series FX3U-ENET Firmware version 1.14 and prior, FX3U-ENET-L Firmware version 1.14 and prior and FX3U-ENET-P502 Firmware version 1.14 and prior allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in communication function of the product or other unspecified effects by sending specially crafted packets to an unnecessary opening of TCP port. Control by MELSEC-F series PLC is not affected by this vulnerability, but system reset is required for recovery.

Affected products (as reported)

Vendor	Product	Versions
n/a	MELSEC-F series FX3U-ENET; MELSEC-F series FX3U-ENET-L; MELSEC-F series FX3U-ENET-P502	Firmware version 1.14 and prior

References

https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-023_en.pdf x_refsource_MISC
https://jvn.jp/vu/JVNVU93268332/index.html x_refsource_MISC
https://www.cisa.gov/uscert/ics/advisories/icsa-22-013-01 x_refsource_MISC