Heimdall Security Logo

CVE-2021-20611

Vulnérabilité élevée dans MELSEC iQ-R Series R00CPU (Mitsubishi Electric Corporation)

CVSS 7.5 · Élevée
EPSS 3.2%
Mitsubishi Electric Corporation•MELSEC iQ-R Series R00CPU•Versions : Firmware versions "16" and prior, Operating system software version "23" and prior, Firmware versions "57" and prior, The first 5 digits of serial No. "23071" and prior, Operating system software version "W" and prior, Firmware versions "26" and prior, Firmware versions "29" and prior, Firmware versions "08" and prior, The first 5 digits of serial No. "24031" and prior, Operating system software version "Y" and prior, The first 5 digits of serial No. "23121" and prior, Firmware versions "05" and prior, Operating system software version "F" and prior, Firmware versions "24" and prior

Description

Improper Input Validation vulnerability in Mitsubishi Electric MELSEC iQ-R Series R00/01/02CPU, MELSEC iQ-R Series R04/08/16/32/120(EN)CPU, MELSEC iQ-R Series R08/16/32/120SFCPU, MELSEC iQ-R Series R08/16/32/120PCPU, MELSEC iQ-R Series R08/16/32/120PSFCPU, MELSEC iQ-R Series R16/32/64MTCPU, MELSEC iQ-R Series R12CCPU-V, MELSEC Q Series Q03UDECPU, MELSEC Q Series Q04/06/10/13/20/26/50/100UDEHCPU, MELSEC Q Series Q03/04/06/13/26UDVCPU, MELSEC Q Series Q04/06/13/26UDPVCPU, MELSEC Q Series Q12DCCPU-V, MELSEC Q Series Q24DHCCPU-V(G), MELSEC Q Series Q24/26DHCCPU-LS, MELSEC Q Series MR-MQ100, MELSEC Q Series Q172/173DCPU-S1, MELSEC Q Series Q172/173DSCPU, MELSEC Q Series Q170MCPU, MELSEC Q Series Q170MSCPU(-S1), MELSEC L Series L02/06/26CPU(-P), MELSEC L Series L26CPU-(P)BT and MELIPC Series MI5122-VW allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted packets. System reset is required for recovery.

Gravité et risque d'exploitation

CVE-2021-20611 obtient un score CVSS de 7.5/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 3.18 %, ce qui la place devant 87.9 % des CVE référencées.

Que faire ?

  • Vérifiez si MELSEC iQ-R Series R00CPU (versions Firmware versions "16" and prior, Operating system software version "23" and prior, Firmware versions "57" and prior, The first 5 digits of serial No. "23071" and prior, Operating system software version "W" and prior, Firmware versions "26" and prior, Firmware versions "29" and prior, Firmware versions "08" and prior, The first 5 digits of serial No. "24031" and prior, Operating system software version "Y" and prior, The first 5 digits of serial No. "23121" and prior, Firmware versions "05" and prior, Operating system software version "F" and prior, Firmware versions "24" and prior) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE